CVE-2010-3739

Published: Oct 5, 2010Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

The audit facility in the Security component in IBM DB2 UDB 9.5 before FP6a uses instance-level audit settings to capture connection (aka CONNECT and AUTHENTICATION) events in certain circumstances in which database-level audit settings were intended, which might make it easier for remote attackers to connect without discovery.

Affected (11)

Products: Ibm: Db2 Universal Database

Ibm

1 product

Db2 Universal Database

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Ibm Db2 Universal Database	Up to 9.5
Ibm Db2 Universal Database	Version 9.5
Ibm Db2 Universal Database	Version 9.5 fp1
Ibm Db2 Universal Database	Version 9.5 fp2
Ibm Db2 Universal Database	Version 9.5 fp2a
Ibm Db2 Universal Database	Version 9.5 fp3
Ibm Db2 Universal Database	Version 9.5 fp3a
Ibm Db2 Universal Database	Version 9.5 fp3b
Ibm Db2 Universal Database	Version 9.5 fp4
Ibm Db2 Universal Database	Version 9.5 fp4a
Ibm Db2 Universal Database	Version 9.5 fp5

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT (unsafe URL)

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg1JR34218

Source: cve@mitre.org

PatchVendor Advisory

ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=swg1JR34218

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.