製品・ソフトウェアに関する情報

JVN脆弱性詳細

IBM DB2 のバイナリにおける任意のファイルを作成される脆弱性

Title	IBM DB2 のバイナリにおける任意のファイルを作成される脆弱性
Summary	IBM DB2 のバイナリには、"安全でないファイルアクセス" に関する処理に不備があるため、任意のファイルを作成される、または変更される脆弱性が存在します。
Possible impacts	ローカルユーザにより、環境変数を介して、任意のファイルを作成される、または変更される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 23, 2007, midnight
Registration Date	Sept. 25, 2012, 4:47 p.m.
Last Update	Sept. 25, 2012, 4:47 p.m.

Affected System

IBM

db2 universal database 8.1 FixPak 15 未満の 8.x、および Fix Pack 2 未満の 9.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2007-1086	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1086
National Vulnerability Database (NVD)
2	CVE-2007-1086	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1086

ベンダー情報

No	Name	URL
IBM
1	IY94833	http://www-01.ibm.com/support/docview.wss?uid=swg1IY94833

Change Log

No	Changed Details	Date of change
0	[2012年09月25日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2007-1086

Summary	Unspecified binaries in IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 allow local users to create or modify arbitrary files via unspecified environment variables related to "unsafe file access."
Publication Date	Feb. 24, 2007, 7:28 a.m.
Registration Date	Jan. 29, 2021, 2:07 p.m.
Last Update	Oct. 31, 2018, 1:25 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ibm:db2_universal_database:8.0::linux:::::
cpe:2.3:a:ibm:db2_universal_database:8.1::aix:::::
cpe:2.3:a:ibm:db2_universal_database:8.1.4:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.5:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.6:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.6c:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.7:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.7b:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.8:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.8a:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.9:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.9a:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.10:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.12:::::::*
cpe:2.3:a:ibm:db2_universal_database:9.1::hp_ux:::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=481	IDEFENSE	Patch
2	http://osvdb.org/40969	OSVDB
3	http://www.attrition.org/pipermail/vim/2007-August/001765.html	VIM
4	http://www.securityfocus.com/bid/22677	BID	Patch
5	http://www-1.ibm.com/support/docview.wss?uid=swg21255747	AIXAPAR
6	https://exchange.xforce.ibmcloud.com/vulnerabilities/32650	XF

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ibm:db2_universal_database:8.0::linux:::::
cpe:2.3:a:ibm:db2_universal_database:8.1::aix:::::
cpe:2.3:a:ibm:db2_universal_database:8.1.4:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.5:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.6:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.6c:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.7:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.7b:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.8:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.8a:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.9:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.1.9a:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.10:::::::*
cpe:2.3:a:ibm:db2_universal_database:8.12:::::::*
cpe:2.3:a:ibm:db2_universal_database:9.1::hp_ux:::::