Resource exhaustion in IBM DB2 - CVE-2023-38720

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU81723

Resource exhaustion in IBM DB2 - CVE-2023-38720

Published: October 10, 2023


Vulnerability identifier: #VU81723
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-38720
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can send a specially crafted ALTER TABLE statement, trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

IBM DB2
IBM License Metric Tool
IBM Tivoli Business Service Manager
IBM Operations Analytics Predictive Insights
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
Db2 Big SQL
dashDB Local
Storage Protect Server

How to mitigate CVE-2023-38720

Install updates from vendor's website.

IBM DB2 - addressed in versions 11.1.4.7, 11.5.0.0, 11.5.7, 11.5.8
Db2 Big SQL - update to 7.6
dashDB Local - update to 11.5.9.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.21

External References

Related Security Bulletins