Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as CVE-2008-0697.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
IBM DB2数据库db2db本地权限提升漏洞
Vulnerability Description
IBM DB2是美国IBM公司的一套关系型数据库管理系统。该系统的执行环境主要有UNIX、Linux、IBM i、z/OS以及Windows服务器版本。 在设置DB2INSTANCE环境变量的时候，libdb2库会使用相关用户的目录而不是DB2例程目录，这会允许本地非特权用户控制一些set-uid root二进制程序所操作的目录结构。 该漏洞是由于db2pd二进制程序加载库的方式所导致的。程序会通过将例程目录的路径连接到静态字符串/SQLlib/lib/libdb2fmtdmp.so来创建到所要加载库的路
CVSS Information
N/A
Vulnerability Type
N/A