CVE-2009-4333: Infoleak
Published Dec 16, 2009
·Updated
The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command.
Affected Software
7 affected components
IBM DB2=9.5
IBM DB2=9.5-fp1
IBM DB2=9.5-fp2a
IBM DB2=9.5-fp3b
IBM DB2=9.5-fp2
IBM DB2=9.5-fp3
IBM DB2=9.5-fp3a
Remediation
Patch Available
Event History
Dec 16, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-4333?
CVE-2009-4333 is rated as medium severity due to the potential for unauthorized access to sensitive information.
2
How do I fix CVE-2009-4333?
To remediate CVE-2009-4333, it is recommended to upgrade to a patched version of IBM DB2 9.5, specifically after FP5.
3
What versions of IBM DB2 are affected by CVE-2009-4333?
CVE-2009-4333 affects IBM DB2 version 9.5 and its fix packs before FP5.
4
What type of vulnerability is CVE-2009-4333?
CVE-2009-4333 is a vulnerability related to information disclosure that can expose passwords.
5
Is there a workaround for CVE-2009-4333?
There are no known effective workarounds for CVE-2009-4333 other than applying the security updates provided by IBM.