CVE-2014-0919: Infoleak
First published: Fri May 08 2015(Updated: )
IBM DB2 9.5 through 10.5 on Linux, UNIX, and Windows stores passwords during the processing of certain SQL statements by the monitoring and audit facilities, which allows remote authenticated users to obtain sensitive information via commands associated with these facilities.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM DB2 Universal Database | =9.5 | |
| IBM DB2 Universal Database | =9.5 | |
| IBM DB2 Universal Database | =9.5 | |
| IBM DB2 Universal Database | =9.5 | |
| IBM DB2 Universal Database | =9.5 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT07397
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT07547
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT07552
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT07553
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT07554
- http://www-01.ibm.com/support/docview.wss?uid=swg21698021
- http://www.securityfocus.com/bid/74217
- http://www.securitytracker.com/id/1032247
Frequently Asked Questions
What is the severity of CVE-2014-0919?
CVE-2014-0919 is rated as a medium severity vulnerability due to its potential to leak sensitive information.
How do I fix CVE-2014-0919?
To fix CVE-2014-0919, update IBM DB2 to the latest version that addresses this vulnerability.
What systems are affected by CVE-2014-0919?
CVE-2014-0919 affects IBM DB2 versions 9.5 through 10.5 on Linux, UNIX, and Windows platforms.
What type of information can be exposed due to CVE-2014-0919?
CVE-2014-0919 can expose sensitive password information stored during SQL statement processing.
Can CVE-2014-0919 be exploited remotely?
Yes, CVE-2014-0919 can be exploited by remote authenticated users through monitoring and audit command facilities.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm db2 universal database
- version/ibm db2 universal database/9.5
- version/ibm db2 universal database/9.7
- version/ibm db2 universal database/9.8
- version/ibm db2 universal database/10.1
- version/ibm db2 universal database/10.5