Vulnerability Description
The Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not enforce privilege requirements for access to a (1) sequence or (2) global-variable object, which allows remote authenticated users to make use of data via unspecified vectors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Db2 | 9.1 |
Related Weaknesses (CWE)
References
- ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APA
- http://secunia.com/advisories/37759Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC62543Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC62583Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC64852Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
- http://www-01.ibm.com/support/docview.wss?uid=swg21412902Vendor Advisory
- http://www.securityfocus.com/bid/37332
- http://www.vupen.com/english/advisories/2009/3520PatchVendor Advisory
- ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APA
- http://secunia.com/advisories/37759Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC62543Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC62583Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC64852Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
FAQ
What is CVE-2009-4438?
CVE-2009-4438 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not enforce privilege requirements for access to a (1) sequence or (2) global-va...
How severe is CVE-2009-4438?
CVE-2009-4438 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-4438?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Db2.