CVE-2014-4805 : IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations, which allows local us

IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations, which allows local users to obtain sensitive information by reading a file while a LOAD is occurring.

Published 2014-09-04 10:55:08

Updated 2017-08-29 01:35:08

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2014-4805

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-4805

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

References for CVE-2014-4805

http://www-01.ibm.com/support/docview.wss?uid=swg1IT03761

IBM IT03761: Security: Unauthorized Access to user data vulnerability in DB2 during certain LOAD operations into CDE tables (CVE-2014-4805)
Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95307

Unauthorized Access to user data vulnerability in DB2 CVE-2014-4805 Vulnerability Report
http://www.securitytracker.com/id/1030806

IBM DB2 LOAD Operation Lets Local Users Obtain Potentially Sensitive Information - SecurityTracker
http://www-01.ibm.com/support/docview.wss?uid=swg21681723

IBM Security Bulletin: Unauthorized Access to user data vulnerability in DB2 during certain LOAD operations (CVE-2014-4805)

Products affected by CVE-2014-4805

IBM » DB2 » Version: 10.5
cpe:2.3:a:ibm:db2:10.5:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX
When used together with: Linux » Linux Kernel
IBM » DB2 » Version: 10.5.0.1
cpe:2.3:a:ibm:db2:10.5.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX
When used together with: Linux » Linux Kernel
IBM » DB2 » Version: 10.5.0.2
cpe:2.3:a:ibm:db2:10.5.0.2:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX
When used together with: Linux » Linux Kernel
IBM » DB2 » Version: 10.5.0.3
cpe:2.3:a:ibm:db2:10.5.0.3:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX
When used together with: Linux » Linux Kernel
IBM » DB2 » Version: 10.5.0.3 Update A
cpe:2.3:a:ibm:db2:10.5.0.3:a:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX
When used together with: Linux » Linux Kernel

Vulnerability Details : CVE-2014-4805

Exploit prediction scoring system (EPSS) score for CVE-2014-4805

CVSS scores for CVE-2014-4805

CWE ids for CVE-2014-4805

References for CVE-2014-4805

Products affected by CVE-2014-4805