CVE-2015-1883: Infoleak
First published: Mon Jul 20 2015(Updated: )
IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =9.8 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =10.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT08075
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT08080
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT08085
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT08086
- http://www-01.ibm.com/support/docview.wss?uid=swg21698308
- http://www.securityfocus.com/bid/75946
- http://www.securitytracker.com/id/1032881
Frequently Asked Questions
What is the severity of CVE-2015-1883?
CVE-2015-1883 has been classified with a medium severity, allowing authenticated users to access sensitive files.
How do I fix CVE-2015-1883?
To mitigate CVE-2015-1883, upgrade IBM DB2 to the latest versions above the specified thresholds in its documentation.
What products are affected by CVE-2015-1883?
CVE-2015-1883 affects IBM DB2 versions 9.7, 9.8, 10.1, and 10.5 across Linux, UNIX, and Windows platforms.
Can CVE-2015-1883 be exploited remotely?
Yes, CVE-2015-1883 can be exploited by remote authenticated users who can execute specific stored procedures.
What types of files can be accessed due to CVE-2015-1883?
CVE-2015-1883 allows unauthorized reading of certain administrative files through crafted procedures.
- agent/first-publish-date
- agent/last-modified-date
- agent/type
- agent/weakness
- agent/author
- agent/severity
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm db2 universal database
- version/ibm db2 universal database/9.7
- version/ibm db2 universal database/9.8
- version/ibm db2 universal database/10.1
- version/ibm db2 universal database/10.5