CVE-2017-1520: Medium severity ibm db2 universal database vulnerability
Published Sep 12, 2017
·Updated
IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830.
Affected Software
58 affected components
IBM DB2=9.7
IBM DB2=9.7.0.1
IBM DB2=9.7.0.2
IBM DB2=9.7.0.3
IBM DB2=9.7.0.4
IBM DB2=9.7.0.5
IBM DB2=9.7.0.6
IBM DB2=9.7.0.7
IBM DB2=9.7.0.8
IBM DB2=9.7.0.9
IBM DB2=9.7.0.9-a
IBM DB2=9.7.0.10
IBM DB2=9.7.0.11
IBM DB2=10.1
IBM DB2=10.1.0.1
IBM DB2=10.1.0.2
IBM DB2=10.1.0.3
IBM DB2=10.1.0.4
IBM DB2=10.1.0.5
IBM DB2=10.5
IBM DB2=10.5.0.1
IBM DB2=10.5.0.2
IBM DB2=10.5.0.3
IBM DB2=10.5.0.3-a
IBM DB2=10.5.0.4
IBM DB2=10.5.0.5
IBM DB2=10.5.0.6
IBM DB2=10.5.0.7
IBM DB2=11.1.0.0
IBM DB2 Connect=9.7
IBM DB2 Connect=9.7.0.1
IBM DB2 Connect=9.7.0.2
IBM DB2 Connect=9.7.0.3
IBM DB2 Connect=9.7.0.4
IBM DB2 Connect=9.7.0.5
IBM DB2 Connect=9.7.0.6
IBM DB2 Connect=9.7.0.7
IBM DB2 Connect=9.7.0.8
IBM DB2 Connect=9.7.0.9
IBM DB2 Connect=9.7.0.10
IBM DB2 Connect=9.7.0.11
IBM DB2 Connect=10.1
IBM DB2 Connect=10.1.0.1
IBM DB2 Connect=10.1.0.2
IBM DB2 Connect=10.1.0.3
IBM DB2 Connect=10.1.0.4
IBM DB2 Connect=10.1.0.5
IBM DB2 Connect=10.5
IBM DB2 Connect=10.5.0.1
IBM DB2 Connect=10.5.0.2
IBM DB2 Connect=10.5.0.3
IBM DB2 Connect=10.5.0.4
IBM DB2 Connect=10.5.0.5
IBM DB2 Connect=10.5.0.6
IBM DB2 Connect=10.5.0.7
IBM DB2 Connect=11.1.0.0
Linux Linux kernel
Microsoft Windows
Remediation
Patch Available
Event History
Sep 12, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-1520?
CVE-2017-1520 is classified as a medium severity vulnerability due to its potential to allow unauthorized command execution.
2
How do I fix CVE-2017-1520?
To remediate CVE-2017-1520, upgrade your IBM DB2 installation to a fixed version or apply the necessary patches provided by IBM.
3
What versions of IBM DB2 are affected by CVE-2017-1520?
CVE-2017-1520 affects IBM DB2 versions 9.7, 10.1, 10.5, and 11.1.
4
What is the nature of the vulnerability in CVE-2017-1520?
CVE-2017-1520 allows for unauthorized activation of the database when the authentication type is set to CLIENT.
5
Is CVE-2017-1520 exploitable remotely?
Yes, CVE-2017-1520 can be exploited remotely if the system is improperly configured to accept client-level authentication.