VulnerabilityModified
CVE-2009-1905
The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a…
LOW 2.6EPSS 1.85%
Does this matter?
Lower severity and a low EPSS score (1.85%). Track it; it rarely justifies an emergency change on its own.
Description
The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors.
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
- EPSS
- 1.85% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- ibm/db2
- Source
- cve@mitre.org
References
- ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXTPatch
- http://secunia.com/advisories/31787Vendor Advisory
- http://secunia.com/advisories/35235Vendor Advisory
- http://securitytracker.com/id?1022319
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR32268Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR32272Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR32273Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
- http://www-01.ibm.com/support/docview.wss?uid=swg21318189Patch
- http://www-01.ibm.com/support/docview.wss?uid=swg21386689Patch
- http://www.securityfocus.com/bid/35171
- http://www.securityfocus.com/bid/36540
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50909
- ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXTPatch
- http://secunia.com/advisories/31787Vendor Advisory
- http://secunia.com/advisories/35235Vendor Advisory
- http://securitytracker.com/id?1022319
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR32268Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR32272Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1JR32273Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
- http://www-01.ibm.com/support/docview.wss?uid=swg21318189Patch
- http://www-01.ibm.com/support/docview.wss?uid=swg21386689Patch
- http://www.securityfocus.com/bid/35171
- http://www.securityfocus.com/bid/36540
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50909
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.