CVE-2008-3858 : The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows rem

The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT data stream that simulates a V7 client connect request.

Published 2008-08-28 17:41:00

Updated 2017-08-08 01:32:14

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2008-3858

IBM » Db2 Universal Database » Version: 9.1 Hp Ux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:*:hp_ux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP2 Windows Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:windows:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP3 AIX Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:aix:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP4 Linux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:linux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP4 Solaris Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:solaris:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP4 Windows Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:windows:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 AIX Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:*:aix:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Linux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:*:linux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP2 Linux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:linux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP2 Solaris Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:solaris:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP4 AIX Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:aix:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP4 Hp-ux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp4:hp-ux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP3 Hp-ux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:hp-ux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP3 Linux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:linux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Solaris Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:*:solaris:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Windows Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:*:windows:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP2 AIX Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:aix:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP2 Hp-ux Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp2:hp-ux:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP3 Solaris Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:solaris:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update FP3 Windows Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp3:windows:*:*:*:*:*
Matching versions
IBM » Db2 Universal Database » Version: 9.1 Update Fp4a AIX Edition
cpe:2.3:a:ibm:db2_universal_database:9.1:fp4a:aix:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2008-3858

EPSS FAQ

1.42%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-3858

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2008-3858

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-3858

Jump to

Vulnerability Details : CVE-2008-3858

Products affected by CVE-2008-3858

Exploit prediction scoring system (EPSS) score for CVE-2008-3858

CVSS scores for CVE-2008-3858

CWE ids for CVE-2008-3858

References for CVE-2008-3858