CVE-2020-4976 : IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due to weak file permissions. IBM X-Force ID: 192469.

Published 2021-03-11 16:15:13

Updated 2021-04-12 16:41:10

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2020-4976

IBM » DB2
Versions from including (>=) 11.5 and before (<) 11.5.5.0
cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2
Versions from including (>=) 11.1.0.0 and before (<) 11.1.4.6
cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP1
cpe:2.3:a:ibm:db2:9.7:fp1:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP2
cpe:2.3:a:ibm:db2:9.7:fp2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update Fp3a
cpe:2.3:a:ibm:db2:9.7:fp3a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP4
cpe:2.3:a:ibm:db2:9.7:fp4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP5
cpe:2.3:a:ibm:db2:9.7:fp5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP3
cpe:2.3:a:ibm:db2:9.7:fp3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7
cpe:2.3:a:ibm:db2:9.7:-:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update Fp10
cpe:2.3:a:ibm:db2:9.7:fp10:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP6
cpe:2.3:a:ibm:db2:9.7:fp6:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP7
cpe:2.3:a:ibm:db2:9.7:fp7:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP8
cpe:2.3:a:ibm:db2:9.7:fp8:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP9
cpe:2.3:a:ibm:db2:9.7:fp9:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update Fp9a
cpe:2.3:a:ibm:db2:9.7:fp9a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1
cpe:2.3:a:ibm:db2:10.1:-:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP1
cpe:2.3:a:ibm:db2:10.1:fp1:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP2
cpe:2.3:a:ibm:db2:10.1:fp2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP3
cpe:2.3:a:ibm:db2:10.1:fp3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update Fp3a
cpe:2.3:a:ibm:db2:10.1:fp3a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP4
cpe:2.3:a:ibm:db2:10.1:fp4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP5
cpe:2.3:a:ibm:db2:10.1:fp5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5
cpe:2.3:a:ibm:db2:10.5:-:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP1
cpe:2.3:a:ibm:db2:10.5:fp1:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP2
cpe:2.3:a:ibm:db2:10.5:fp2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP3
cpe:2.3:a:ibm:db2:10.5:fp3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update Fp3a
cpe:2.3:a:ibm:db2:10.5:fp3a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP4
cpe:2.3:a:ibm:db2:10.5:fp4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP5
cpe:2.3:a:ibm:db2:10.5:fp5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP6
cpe:2.3:a:ibm:db2:10.5:fp6:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP7
cpe:2.3:a:ibm:db2:10.5:fp7:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP8
cpe:2.3:a:ibm:db2:10.5:fp8:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP9
cpe:2.3:a:ibm:db2:10.5:fp9:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-4976

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-4976

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.6	LOW	AV:L/AC:L/Au:N/C:P/I:P/A:N	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
5.1	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	2.5	2.5	IBM Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	1.8	2.5	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2020-4976

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-4976

https://security.netapp.com/advisory/ntap-20210409-0003/

March 2021 IBM DB2 Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/192469

IBM DB2 for Linux, UNIX and Windows file write CVE-2020-4976 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6427859

Security Bulletin: IBM® Db2® is vulnerable to weak file permissions allowing access to specific files (CVE-2020-4976)
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-4976

Products affected by CVE-2020-4976

Exploit prediction scoring system (EPSS) score for CVE-2020-4976

CVSS scores for CVE-2020-4976

CWE ids for CVE-2020-4976

References for CVE-2020-4976