CVE-2018-1566 : IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023.

Published 2018-07-10 16:29:01

Updated 2019-10-09 23:38:41

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2018-1566

IBM » DB2 » Version: 9.7
cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel
IBM » DB2 » Version: 10.1
cpe:2.3:a:ibm:db2:10.1:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel
IBM » DB2 » Version: 10.5
cpe:2.3:a:ibm:db2:10.5:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel
IBM » DB2 » Version: 11.1
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel

Exploit prediction scoring system (EPSS) score for CVE-2018-1566

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 8 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1566

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.4	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	IBM Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-1566

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1566

http://www.securityfocus.com/bid/104740

IBM DB2 CVE-2018-1566 Local Format String Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1041229

IBM DB2 Format String Flaw in 'db2support' May Let Local Users Gain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/143023

IBM DB2 code execution CVE-2018-1566 Vulnerability Report
Third Party Advisory;VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22016182

IBM Security Bulletin: Format string vulnerability in IBM® Db2® tool db2support (CVE-2018-1566).
Vendor Advisory

Jump to

Vulnerability Details : CVE-2018-1566

Products affected by CVE-2018-1566

Exploit prediction scoring system (EPSS) score for CVE-2018-1566

CVSS scores for CVE-2018-1566

CWE ids for CVE-2018-1566

References for CVE-2018-1566