Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2016-5995 |
CWE-ID | CWE-284 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
IBM InfoSphere Replication Server Server applications / Other server solutions IBM DB2 Server applications / Database software |
Vendor |
IBM Corporation |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU530
Risk: High
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-5995
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability exposes local user's possibility to get root privileges on the target system.
The weakness exists due to access control error. Creating a specially crafted library a malicious user can get elevated privileges and induce the application to arbitrary code execution.
Successful exploitation of the vulnerability allows a local user to gain root privileges on the vulnerable system.
Update to 10.5 FP8.
Vulnerable software versionsIBM InfoSphere Replication Server: 9.7
IBM DB2: 10.1 - 10.5
: 11.1
External linkshttp://www.ibm.com/support/docview.wss?uid=swg21990061
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.