CVE-2018-1685: Infoleak

Published Sep 21, 2018

Updated

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user to read any file on the system. IBM X-Force ID: 145502.

Affected Software

6 affected components

IBM DB2=9.7

IBM DB2=10.1

IBM DB2=10.5

IBM DB2=11.1

Linux Linux kernel

Microsoft Windows

Event History

Sep 21, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-1685?

CVE-2018-1685 has a high severity rating due to its potential to allow local users to read any file on the system.

How do I fix CVE-2018-1685?

To fix CVE-2018-1685, update to the latest version of IBM DB2 or apply available security patches.

Who is affected by CVE-2018-1685?

CVE-2018-1685 affects local users on IBM DB2 versions 9.7, 10.1, 10.5, and 11.1 for Linux, UNIX, and Windows.

What are the potential impacts of CVE-2018-1685?

The potential impacts of CVE-2018-1685 include unauthorized access to confidential files by local users.

Is there a workaround for CVE-2018-1685?

There are no specific workarounds for CVE-2018-1685; the recommended approach is to apply the security updates.