IBM fixed a shared memory vulnerability in its Db2 data management products that can be exploited by malicious local users to access sensitive data.
The vulnerability, which is tracked as CVE-2020-4414, was discovered by researchers from Trustwave, it is caused by the lack of explicit memory protections for the shared memory used by Db2 trace facility.
An ill-intentioned local user could exploit the issue to achieve read and write access to that memory, potentially accessing sensitive data. The flaw can also be exploited to modify the functionality of the trace subsystem, triggering a denial of service condition in the database.
“In Windows, launch Process Explorer or other any similar tool to check open handles of Db2 main process. As you can see below, there are absolutely no permissions assigned to the shared memory so that anyone can read from and write to it.” reads the post published by Trustwave. “In the end this means that an unprivileged local user can abuse this to cause a denial of service condition simply by writing incorrect data over that memory section.”
An attacker could exploit the flaw by sending specially crafted requests to vulnerable installs.
The vulnerability impacts IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server), versions 9.7, 10.1, 10.5, 11.1, and 11.5.
IBM addressed the issue with the release of a patch on June 30.
Companies should apply security patches to their IBM Db2 installs as soon as possible.
Trustwave researcher in June discovered a similar vulnerability in Cisco Webex Meetings client for Windows, tracked as CVE-2020-3347, that could allow local authenticated attackers to gain access to sensitive information.
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, IBM DB2)
[adrotate banner=”5″]
[adrotate banner=”13″]
Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…
Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…
The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…
This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…
The Finnish Police attributed the attack against the parliament that occurred in March 2021 to…
This website uses cookies.