CVE-2008-1998 : The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before F

The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter.

Published 2008-04-28 20:05:00

Updated 2025-04-09 00:30:58

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2008-1998

IBM » DB2 » Version: 8.0 Update FP8
cpe:2.3:a:ibm:db2:8.0:fp8:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp13
cpe:2.3:a:ibm:db2:8.0:fp13:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 9.1 Update FP1
cpe:2.3:a:ibm:db2:9.1:fp1:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP9
cpe:2.3:a:ibm:db2:8.0:fp9:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp14
cpe:2.3:a:ibm:db2:8.0:fp14:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 9.1 Update FP2
cpe:2.3:a:ibm:db2:9.1:fp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 9.1 Update FP3
cpe:2.3:a:ibm:db2:9.1:fp3:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 9.1 Update Fp3a
cpe:2.3:a:ibm:db2:9.1:fp3a:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 9.1 Update FP4
cpe:2.3:a:ibm:db2:9.1:fp4:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 9.5
cpe:2.3:a:ibm:db2:9.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP5
cpe:2.3:a:ibm:db2:8.0:fp5:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp7b
cpe:2.3:a:ibm:db2:8.0:fp7b:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP1
cpe:2.3:a:ibm:db2:8.0:fp1:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp6b
cpe:2.3:a:ibm:db2:8.0:fp6b:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp6c
cpe:2.3:a:ibm:db2:8.0:fp6c:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp9a
cpe:2.3:a:ibm:db2:8.0:fp9a:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp10
cpe:2.3:a:ibm:db2:8.0:fp10:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP2
cpe:2.3:a:ibm:db2:8.0:fp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP3
cpe:2.3:a:ibm:db2:8.0:fp3:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP4
cpe:2.3:a:ibm:db2:8.0:fp4:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP7
cpe:2.3:a:ibm:db2:8.0:fp7:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp7a
cpe:2.3:a:ibm:db2:8.0:fp7a:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp11
cpe:2.3:a:ibm:db2:8.0:fp11:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp12
cpe:2.3:a:ibm:db2:8.0:fp12:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update FP6
cpe:2.3:a:ibm:db2:8.0:fp6:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp6a
cpe:2.3:a:ibm:db2:8.0:fp6a:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp8a
cpe:2.3:a:ibm:db2:8.0:fp8a:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
IBM » DB2 » Version: 8.0 Update Fp15
cpe:2.3:a:ibm:db2:8.0:fp15:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows

Exploit prediction scoring system (EPSS) score for CVE-2008-1998

EPSS FAQ

1.92%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 82 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-1998

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.5	HIGH	AV:N/AC:M/Au:S/C:C/I:C/A:C	6.8	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2008-1998

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-1998

http://www.appsecinc.com/resources/alerts/db2/2008-03.shtml

Third Party Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06977

Vendor Advisory
http://www.securityfocus.com/bid/28836

Third Party Advisory;VDB Entry
http://secunia.com/advisories/29784

Third Party Advisory

CVEs referencing this url
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ10776

Vendor Advisory
http://secunia.com/advisories/29022

Third Party Advisory

CVEs referencing this url
http://securityreason.com/securityalert/3840

Third Party Advisory
http://www.securityfocus.com/archive/1/491073/100/0/threaded

Third Party Advisory;VDB Entry
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06976

Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41960

Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2008-1998

Products affected by CVE-2008-1998

Exploit prediction scoring system (EPSS) score for CVE-2008-1998

CVSS scores for CVE-2008-1998

CWE ids for CVE-2008-1998

References for CVE-2008-1998