CVE-2019-4057: High severity ibm db2 universal database vulnerability
Published Jul 1, 2019
·Updated
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB2 instance account to leverage a fenced execution process to execute arbitrary code as root. IBM X-Force ID: 156567.
Affected Software
37 affected components
IBM DB2=9.7.0.0
IBM DB2=9.7.0.1
IBM DB2=9.7.0.2
IBM DB2=9.7.0.3
IBM DB2=9.7.0.4
IBM DB2=9.7.0.5
IBM DB2=9.7.0.6
IBM DB2=9.7.0.7
IBM DB2=9.7.0.8
IBM DB2=9.7.0.9
IBM DB2=9.7.0.10
IBM DB2=9.7.0.11
IBM DB2=10.1.0.0
IBM DB2=10.1.0.1
IBM DB2=10.1.0.2
IBM DB2=10.1.0.3
IBM DB2=10.1.0.4
IBM DB2=10.1.0.5
IBM DB2=10.1.0.6
IBM DB2=10.5.0.0
IBM DB2=10.5.0.1
IBM DB2=10.5.0.2
IBM DB2=10.5.0.3
IBM DB2=10.5.0.4
IBM DB2=10.5.0.5
IBM DB2=10.5.0.6
IBM DB2=10.5.0.7
IBM DB2=10.5.0.8
IBM DB2=10.5.0.9
IBM DB2=10.5.0.10
IBM DB2=11.1.0.0
IBM DB2=11.1.1.1
IBM DB2=11.1.2.2
IBM DB2=11.1.3.3
IBM DB2=11.1.4.4
Linux Linux kernel
Microsoft Windows
Event History
Jul 1, 2019
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-4057?
CVE-2019-4057 is rated as a high severity vulnerability, allowing arbitrary code execution as root.
2
What could happen if CVE-2019-4057 is exploited?
If exploited, CVE-2019-4057 could allow a malicious user to execute arbitrary code on the DB2 instance with root privileges.
3
How do I fix CVE-2019-4057?
To fix CVE-2019-4057, users should update their IBM DB2 to the latest version recommended by IBM.
4
Which IBM DB2 versions are affected by CVE-2019-4057?
CVE-2019-4057 affects IBM DB2 versions 9.7, 10.1, 10.5, and 11.1.
5
What is the cause of CVE-2019-4057?
CVE-2019-4057 is caused by improper handling of fenced execution processes within the DB2 instance.