Out-of-bounds write in IBM DB2 - CVE-2023-35012

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU78917

Out-of-bounds write in IBM DB2 - CVE-2023-35012

Published: August 3, 2023


Vulnerability identifier: #VU78917
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-35012
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote privileged user can send a specially crafted file, trigger an out-of-bounds write and execute arbitrary code on the target system.


Affected software

IBM DB2
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
IBM Operations Analytics Predictive Insights
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
IBM OpenPages with Watson
dashDB Local
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Db2 Big SQL

How to mitigate CVE-2023-35012

Install updates from vendor's website.

IBM DB2 - addressed in versions 11.5.7, 11.5.8
dashDB Local - update to 11.5.9.0
DB2 on Cloud Pak for Data - update to 4.7.3
DB2 Warehouse on Cloud Pak for Data - update to 4.7.3
Db2 Big SQL - update to 7.5.3
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4

External References

Related Security Bulletins