CVE-2008-3958

IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT/ATTACH data stream that simulates a V7 client connect/attach request. NOTE: this may overlap CVE-2008-3858. NOTE: this issue exists because of an incomplete fix for CVE-2008-3959.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT
http://osvdb.org/48144
http://secunia.com/advisories/31787	Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08134
http://www.securityfocus.com/bid/31058
https://exchange.xforce.ibmcloud.com/vulnerabilities/45133

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:db2::fp16::::::*
	cpe:2.3:a:ibm:db2:8.0:::::::*
	cpe:2.3:a:ibm:db2:8.0:fp10::::::
	cpe:2.3:a:ibm:db2:8.0:fp11::::::
	cpe:2.3:a:ibm:db2:8.0:fp12::::::
	cpe:2.3:a:ibm:db2:8.0:fp13::::::
	cpe:2.3:a:ibm:db2:8.0:fp14::::::
	cpe:2.3:a:ibm:db2:8.0:fp15::::::
	cpe:2.3:a:ibm:db2:8.0:fp2::::::
	cpe:2.3:a:ibm:db2:8.0:fp3::::::
	cpe:2.3:a:ibm:db2:8.0:fp4::::::
	cpe:2.3:a:ibm:db2:8.0:fp5::::::
	cpe:2.3:a:ibm:db2:8.0:fp6::::::
	cpe:2.3:a:ibm:db2:8.0:fp6a::::::
	cpe:2.3:a:ibm:db2:8.0:fp6b::::::
	cpe:2.3:a:ibm:db2:8.0:fp6c::::::
	cpe:2.3:a:ibm:db2:8.0:fp7::::::
	cpe:2.3:a:ibm:db2:8.0:fp7a::::::
	cpe:2.3:a:ibm:db2:8.0:fp7b::::::
	cpe:2.3:a:ibm:db2:8.0:fp8::::::
	cpe:2.3:a:ibm:db2:8.0:fp8a::::::
	cpe:2.3:a:ibm:db2:8.0:fp9::::::
	cpe:2.3:a:ibm:db2:8.0:fp9a::::::

History

No history.

Information

Published : 2008-09-11 01:13

Updated : 2017-08-08 01:32

NVD link : CVE-2008-3958

Mitre link : CVE-2008-3958

CVE.ORG link : CVE-2008-3958

JSON object : View

Products Affected

ibm

db2

CWE

NVD-CWE-noinfo

{"id": "CVE-2008-3958", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-09-11T01:13:47.523", "references": [{"url": "ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/48144", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/31787", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08134", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/31058", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45133", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT/ATTACH data stream that simulates a V7 client connect/attach request. NOTE: this may overlap CVE-2008-3858. NOTE: this issue exists because of an incomplete fix for CVE-2008-3959."}, {"lang": "es", "value": "IBM DB2 UDB 8 antes del Fixpak 17 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda de la instancia) mediante una cadena de datos CONNECT/ATTACH manipulada que simula una petici\u00f3n de cliente V7 conectar/adjuntar. NOTA: esto podr\u00eda superponerse con CVE-2008-3858. NOTA: este problema existe debido a un parche incompleto para CVE-2008-3959."}], "lastModified": "2017-08-08T01:32:17.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:*:fp16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A94F484-424C-4DF3-9327-95CFC7B4A83E", "versionEndIncluding": "8.0"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC1FC760-D058-4DE6-80B3-F3AA22757A10"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBE50207-5779-445A-B3E7-FA548242BD8F"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "940D9A1D-DD61-4C78-8ADC-434F78E5626B"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2185F942-DCEC-4EE4-840E-62C4C6F1D6FB"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "333F67D2-27CC-4013-B3FA-63BF6F557269"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77D67C50-31B6-4058-9B4D-F06EF8D9B3BC"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5AA59598-F121-491D-BE8C-D7712A3D6E99"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72FA9A16-8AFD-4D93-95B4-EAB6E6030D7C"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB299EAB-31AA-4BAA-B477-0F909A8418AA"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FD22E1E-F5BC-45D5-98F4-EDEE87D718F1"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "222C1B84-0C28-451F-BB02-4CB925263312"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08177181-660C-4BF4-9031-74EE89297CE5"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp6a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB51AF7F-6D09-4EEE-AE8E-E6CCF06C28E4"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp6b:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64BC5E59-361E-4343-9BB9-9772D47E57B0"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp6c:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2E1FC49-96AF-4933-BBE8-71DAEAEDD855"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B5FF14E-2971-4F3F-AD25-D00B0FEDA08F"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp7a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56B7F547-3519-4A12-AB65-C1768153A7DC"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp7b:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE9D14B8-5B4E-4D27-88B9-EBAC46D8282C"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19584860-5ADF-4647-AF39-88C236407FAC"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp8a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6669F847-ED6A-422F-85F7-DAF9B0159F01"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20FE296C-25D0-4689-BAA3-AFCA2C1CC388"}, {"criteria": "cpe:2.3:a:ibm:db2:8.0:fp9a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8D354AD-995D-4FC8-A7C4-7860549A1634"}], "operator": "OR"}]}], "evaluatorComment": "http://secunia.com/advisories/31787\r\n\r\nSome vulnerabilities have been reported in DB2, where some have an unknown impact and others can be exploited by malicious users to perform certain actions with escalated privileges, and by malicious people to cause a DoS or potentially compromise a vulnerable system.", "sourceIdentifier": "cve@mitre.org"}