CVE-2018-1780: High severity IBM DB2 vulnerability

Published Nov 9, 2018

Updated

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local db2 instance owner to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148803.

Affected Software

6 affected components

IBM DB2=9.7

IBM DB2=10.1

IBM DB2=10.5

IBM DB2=11.1

Linux Linux kernel

Microsoft Windows

Event History

Nov 9, 2018

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-1780?

CVE-2018-1780 has a high severity rating due to the potential for local db2 instance owners to gain root access.

How do I fix CVE-2018-1780?

To fix CVE-2018-1780, apply the latest security patches provided by IBM for affected versions of DB2.

Which versions of IBM DB2 are affected by CVE-2018-1780?

CVE-2018-1780 affects IBM DB2 versions 9.7, 10.1, 10.5, and 11.1.

Can a symbolic link attack exploit CVE-2018-1780?

Yes, CVE-2018-1780 can be exploited through a symbolic link attack allowing unauthorized file access.

Is CVE-2018-1780 applicable to both Linux and Windows systems?

CVE-2018-1780 is applicable specifically to IBM DB2 for Linux, UNIX and Windows, affecting local db2 instance owners.