CVE-2019-4094
First published: Tue Mar 19 2019(Updated: )
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to root by loading a malicious shared library. IBM X-Force ID: 158014.
Credit: psirt@us.ibm.com psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =11.1 | |
| Linux Kernel | ||
| IBM DB2 Universal Database | =9.7 | |
| IBM DB2 Universal Database | =10.1 | |
| IBM DB2 Universal Database | =10.5 | |
| IBM DB2 Universal Database | =11.1 | |
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-4094?
CVE-2019-4094 is classified as having a high severity due to its potential to grant low privilege users full root access.
How do I fix CVE-2019-4094?
To mitigate CVE-2019-4094, users should ensure that DB2 binaries are not allowed to load shared libraries from untrusted paths.
Who is affected by CVE-2019-4094?
CVE-2019-4094 affects IBM DB2 versions 9.7, 10.1, 10.5, and 11.1 running on Linux, UNIX, and Windows.
What are the consequences of CVE-2019-4094?
The primary consequence of CVE-2019-4094 is that it allows a low privilege user to potentially gain full access to the system by loading a malicious library.
Is there a specific version of DB2 that is particularly vulnerable to CVE-2019-4094?
All affected versions of IBM DB2 from 9.7 to 11.1 are vulnerable to CVE-2019-4094 if they are configured to load shared libraries from untrusted paths.
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/author
- agent/last-modified-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/ibm
- canonical/ibm db2 universal database
- version/ibm db2 universal database/9.7
- version/ibm db2 universal database/10.1
- version/ibm db2 universal database/10.5
- version/ibm db2 universal database/11.1
- vendor/linux
- canonical/linux kernel