CVE-2010-3475
First published: Mon Sep 20 2010(Updated: )
IBM DB2 9.7 before FP3 does not properly enforce privilege requirements for execution of entries in the dynamic SQL cache, which allows remote authenticated users to bypass intended access restrictions by leveraging the cache to execute an UPDATE statement contained in a compiled compound SQL statement.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Db2 | =9.7.0.1 | |
| IBM Db2 | =9.7.0.2 | |
| IBM Db2 | =9.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/41444
- http://www.vupen.com/english/advisories/2010/2425
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC70406
- http://www.securityfocus.com/bid/43291
- http://www.ibm.com/support/docview.wss?uid=swg21446455
- http://osvdb.org/68122
- http://www.securitytracker.com/id?1024458
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61873
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14609
Frequently Asked Questions
What is the severity of CVE-2010-3475?
CVE-2010-3475 is classified as having a medium severity due to its potential to allow unauthorized data manipulation.
How do I fix CVE-2010-3475?
To fix CVE-2010-3475, update IBM DB2 to at least version 9.7 FP3 or later.
What are the potential impacts of CVE-2010-3475?
The vulnerability can allow remote authenticated users to execute unauthorized SQL statements, which can lead to data integrity issues.
Which versions of IBM DB2 are affected by CVE-2010-3475?
CVE-2010-3475 affects IBM DB2 versions 9.7.0.1, 9.7.0.2, and 9.7 without the latest fixes.
Who can exploit CVE-2010-3475?
CVE-2010-3475 can be exploited by remote authenticated users with access to the dynamic SQL cache.
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/ibm
- canonical/ibm db2
- version/ibm db2/9.7.0.1
- version/ibm db2/9.7.0.2
- version/ibm db2/9.7