CVE-2020-5025 : IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 193661.

Published 2021-03-11 16:15:13

Updated 2021-04-12 16:40:54

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2020-5025

IBM » DB2
Versions from including (>=) 11.5 and before (<) 11.5.5.0
cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2
Versions from including (>=) 11.1.0.0 and before (<) 11.1.4.6
cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP1
cpe:2.3:a:ibm:db2:9.7:fp1:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP2
cpe:2.3:a:ibm:db2:9.7:fp2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update Fp3a
cpe:2.3:a:ibm:db2:9.7:fp3a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP4
cpe:2.3:a:ibm:db2:9.7:fp4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP5
cpe:2.3:a:ibm:db2:9.7:fp5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP3
cpe:2.3:a:ibm:db2:9.7:fp3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7
cpe:2.3:a:ibm:db2:9.7:-:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update Fp10
cpe:2.3:a:ibm:db2:9.7:fp10:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP6
cpe:2.3:a:ibm:db2:9.7:fp6:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP7
cpe:2.3:a:ibm:db2:9.7:fp7:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP8
cpe:2.3:a:ibm:db2:9.7:fp8:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update FP9
cpe:2.3:a:ibm:db2:9.7:fp9:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 9.7 Update Fp9a
cpe:2.3:a:ibm:db2:9.7:fp9a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1
cpe:2.3:a:ibm:db2:10.1:-:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP1
cpe:2.3:a:ibm:db2:10.1:fp1:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP2
cpe:2.3:a:ibm:db2:10.1:fp2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP3
cpe:2.3:a:ibm:db2:10.1:fp3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update Fp3a
cpe:2.3:a:ibm:db2:10.1:fp3a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP4
cpe:2.3:a:ibm:db2:10.1:fp4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.1 Update FP5
cpe:2.3:a:ibm:db2:10.1:fp5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5
cpe:2.3:a:ibm:db2:10.5:-:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP1
cpe:2.3:a:ibm:db2:10.5:fp1:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP2
cpe:2.3:a:ibm:db2:10.5:fp2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP3
cpe:2.3:a:ibm:db2:10.5:fp3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update Fp3a
cpe:2.3:a:ibm:db2:10.5:fp3a:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP4
cpe:2.3:a:ibm:db2:10.5:fp4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP5
cpe:2.3:a:ibm:db2:10.5:fp5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP6
cpe:2.3:a:ibm:db2:10.5:fp6:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP7
cpe:2.3:a:ibm:db2:10.5:fp7:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP8
cpe:2.3:a:ibm:db2:10.5:fp8:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
IBM » DB2 » Version: 10.5 Update FP9
cpe:2.3:a:ibm:db2:10.5:fp9:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-5025

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-5025

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.4	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	IBM Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-5025

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-5025

https://security.netapp.com/advisory/ntap-20210409-0003/

March 2021 IBM DB2 Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/193661

IBM DB2 for Linux, UNIX and Windows buffer overflow CVE-2020-5025 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6427855

Security Bulletin: IBM® Db2® db2fm is vulnerable to a buffer overflow (CVE-2020-5025)
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-5025

Products affected by CVE-2020-5025

Exploit prediction scoring system (EPSS) score for CVE-2020-5025

CVSS scores for CVE-2020-5025

CWE ids for CVE-2020-5025

References for CVE-2020-5025