CVE-2013-4033
First published: Wed Aug 28 2013(Updated: )
IBM DB2 and DB2 Connect 9.7 through FP8, 9.8 through FP5, 10.1 through FP2, and 10.5 through FP1 allow remote authenticated users to execute DML statements by leveraging EXPLAIN authority.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ibm Db2 | =9.7 | |
| Ibm Db2 | =9.8 | |
| Ibm Db2 | =10.1 | |
| Ibm Db2 | =10.5 | |
| IBM DB2 Connect | =9.5 | |
| IBM DB2 Connect | =9.7 | |
| IBM DB2 Connect | =9.8 | |
| IBM DB2 Connect | =10.1 | |
| IBM DB2 Connect | =10.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC94523
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC94756
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC94757
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC94758
- http://www-01.ibm.com/support/docview.wss?uid=swg21646809
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86093
Frequently Asked Questions
What is the severity of CVE-2013-4033?
CVE-2013-4033 has a medium severity rating, indicating a potential risk to systems using the affected IBM DB2 versions.
How do I fix CVE-2013-4033?
To fix CVE-2013-4033, apply the recommended patches or update to non-vulnerable versions of IBM DB2 and DB2 Connect.
Who is affected by CVE-2013-4033?
CVE-2013-4033 affects remote authenticated users of IBM DB2 and DB2 Connect on specific versions listed in the vulnerability details.
What kind of attacks can CVE-2013-4033 facilitate?
CVE-2013-4033 can facilitate unauthorized execution of DML statements by users with EXPLAIN authority.
Is there a workaround for CVE-2013-4033?
While the primary solution is to patch, a temporary workaround may include restricting EXPLAIN authority for users until a patch is applied.
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm db2
- version/ibm db2/9.7
- version/ibm db2/9.8
- version/ibm db2/10.1
- version/ibm db2/10.5
- canonical/ibm db2 connect
- version/ibm db2 connect/9.5
- version/ibm db2 connect/9.7
- version/ibm db2 connect/9.8
- version/ibm db2 connect/10.1
- version/ibm db2 connect/10.5