Security Bulletin
Summary
IBM® DB2® is shipped as a component of IBM PureData System for Operational Analytics. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin (CVE-2020-4230,CVE-2020-4135,CVE-2020-4204,CVE-2020-4200).
Vulnerability Details
CVEID: CVE-2020-4135
DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a denial of service from excessive memory usage.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173806 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2020-4230
DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an authenticated local attacker with special permissions executes specially crafted Db2 commands. IBM X-Force ID: 175212.
CVSS Base score: 6.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/175212 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2020-4204
DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 174960.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/174960 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2020-4200
DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send specially crafted commands to cause a denial of service. IBM X-Force ID: 174914.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/174914 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM PureData System for Operational Analytics V1.1 (A1801)
Remediation/Fixes
Determine the appliance fixpack level as root on the management server using the appl_ls_cat command.
$ appl_ls_cat -i
NAME VERSION STATUS DESCRIPTION
bwr3 4.0.8.0 Committed Updates for IBM_PureData_System_for_Operational_Analytics
Determine the version of Db2 used on the core nodes in the appliance. The command below shows that Version 10.5.0.11 is installed. The number of hosts, Db2 version and instance name are customer dependent. The appliance supports Db2 10.5 or Db2 11.1 and the default instance owner is bcuaix. The command below shows that the instance is used Db2 10.5.0.11.
$ dsh -n ${BCUALL} '/usr/local/bin/db2ls -c | grep -v "#" | cut -d: -f 1 | head -1 | while read p;do $p/bin/db2greg -dump | grep "^I";done'| dshbak -c
HOSTS -------------------------------------------------------------------------
host02, host04, host05, hostflash06
-------------------------------------------------------------------------------
I,DB2,10.5.0.11,bcuaix,/db2home/bcuaix/sqllib,,1,0,/usr/IBM/dwe/db2/V10.5.0.11..2,,
Login as the instance owner to any of the host servers. The following command will show the build number installed.
$ db2level
DB21085I This instance or install (instance name, where applicable: "bcuaix")
uses "64" bits and DB2 code release "SQL1005B" with level identifier
"060C010E".
Informational tokens are "DB2 v10.5.0.11", "special_40479", "IP24071_40479",
and Fix Pack "11".
Product is installed at "/usr/IBM/dwe/db2/V10.5.0.11..2".
Use the table below to determine how to download the Db2 Fixpack or Special Build and then refer to the appliance technote https://www.ibm.com/support/pages/installing-db2-fix-pack-ibm-puredata-system-operational-analytics for instructions on how to apply the Db2 Fixpack or Special Build on the appliance. Contact IBM Support for any questions or concerns related to this update. The number in brackets will match version returned by the appl_ls_conf command.
| Current V1.1 Fixpack Level | Remediation Options |
| V1.1 GA [ 4.0.4.x ] |
Update to V1.1 FP4 or DB2 Version 10.5 Fix Pack 11 for Linux, UNIX, and Windows |
| V1.1 FP1 [ 4.0.5.x ] |
Update to V1.1 FP4 or DB2 Version 10.5 Fix Pack 11 for Linux, UNIX, and Windows |
| V1.1 FP2 [ 4.0.6.x ] |
Update to V1.1 FP4 or DB2 Version 10.5 Fix Pack 11 for Linux, UNIX, and Windows |
| V1.1 FP3 [ 4.0.7.x ] |
Update to V1.1 FP4 or DB2 Version 10.5 Fix Pack 11 for Linux, UNIX, and Windows |
| V1.1 FP4 [ 4.0.8.x ] |
Validated stack is not vulnerable at this level. |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
22 June 2022: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
23 June 2022
UID
ibm16597969