Shared memory flaw in IBM Db2 can lead to Information Disclosure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-3347 | A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affec A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. The vulnerability is due to unsafe usage of shared memory that is used by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens that could aid the attacker in future attacks. NVD description · AI analysis pending | 5.5 | <1% |
| — | ||
| CVE-2020-4414 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local attacker to perform unauthorized actions o IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local attacker to perform unauthorized actions on the system, caused by improper usage of shared memory. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service. IBM X-Force ID: 179989. NVD description · AI analysis pending | 4.4 | <1% |
| — |
Full article306 words · extracted from securityaffairs.com · click to collapse
IBM addressed a shared memory vulnerability in its Db2 data management solutions that could lead to information disclosure.
IBM fixed a shared memory vulnerability in its Db2 data management products that can be exploited by malicious local users to access sensitive data.
The vulnerability, which is tracked as CVE-2020-4414, was discovered by researchers from Trustwave, it is caused by the lack of explicit memory protections for the shared memory used by Db2 trace facility.
An ill-intentioned local user could exploit the issue to achieve read and write access to that memory, potentially accessing sensitive data. The flaw can also be exploited to modify the functionality of the trace subsystem, triggering a denial of service condition in the database.
“In Windows, launch Process Explorer or other any similar tool to check open handles of Db2 main process. As you can see below, there are absolutely no permissions assigned to the shared memory so that anyone can read from and write to it.” reads the post published by Trustwave. “In the end this means that an unprivileged local user can abuse this to cause a denial of service condition simply by writing incorrect data over that memory section.”
An attacker could exploit the flaw by sending specially crafted requests to vulnerable installs.
The vulnerability impacts IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server), versions 9.7, 10.1, 10.5, 11.1, and 11.5.
IBM addressed the issue with the release of a patch on June 30.
Companies should apply security patches to their IBM Db2 installs as soon as possible.
Trustwave researcher in June discovered a similar vulnerability in Cisco Webex Meetings client for Windows, tracked as CVE-2020-3347, that could allow local authenticated attackers to gain access to sensitive information.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, IBM DB2)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/107356/security/ibm-db2-information-disclosure.html