CVE-2019-4101: Medium severity IBM DB2 vulnerability

Published Jul 1, 2019

Updated

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 is vulnerable to a denial of service. Users that have both EXECUTE on PDGETDIAGHIST and access to the diagnostic directory on the DB2 server can cause the instance to crash. IBM X-Force ID: 158091.

Affected Software

37 affected components

IBM DB2=9.7.0.0

IBM DB2=9.7.0.1

IBM DB2=9.7.0.2

IBM DB2=9.7.0.3

IBM DB2=9.7.0.4

IBM DB2=9.7.0.5

IBM DB2=9.7.0.6

IBM DB2=9.7.0.7

IBM DB2=9.7.0.8

IBM DB2=9.7.0.9

IBM DB2=9.7.0.10

IBM DB2=9.7.0.11

IBM DB2=10.1.0.0

IBM DB2=10.1.0.1

IBM DB2=10.1.0.2

IBM DB2=10.1.0.3

IBM DB2=10.1.0.4

IBM DB2=10.1.0.5

IBM DB2=10.1.0.6

IBM DB2=10.5.0.0

IBM DB2=10.5.0.1

IBM DB2=10.5.0.2

IBM DB2=10.5.0.3

IBM DB2=10.5.0.4

IBM DB2=10.5.0.5

IBM DB2=10.5.0.6

IBM DB2=10.5.0.7

IBM DB2=10.5.0.8

IBM DB2=10.5.0.9

IBM DB2=10.5.0.10

IBM DB2=11.1.0.0

IBM DB2=11.1.1.1

IBM DB2=11.1.2.2

IBM DB2=11.1.3.3

IBM DB2=11.1.4.4

Linux Linux kernel

Microsoft Windows

Event History

Jul 1, 2019

CVE Published

via MITRE·03:05 PM

Data Sourced

via MITRE·03:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-4101?

CVE-2019-4101 is classified as a denial of service vulnerability affecting IBM DB2.

How do I fix CVE-2019-4101?

To address CVE-2019-4101, ensure that appropriate access controls are implemented to restrict EXECUTE permissions on PD_GET_DIAG_HIST.

Which versions of IBM DB2 are affected by CVE-2019-4101?

CVE-2019-4101 affects IBM DB2 versions 9.7, 10.1, 10.5, and 11.1.

What type of attack does CVE-2019-4101 enable?

CVE-2019-4101 enables an attacker to cause a denial of service by exploiting the database instance.

Is it possible to mitigate the impact of CVE-2019-4101?

Yes, limiting user permissions and monitoring database access can help mitigate the impact of CVE-2019-4101.