IC84751: SECURITY: GET_WRAP_CFG_C AND GET_WRAP_CFG_C2 ALLOWS UNAUTHORIZED ACCESS XML FILES (CVE-2012-2196).

DB2 Version 10.1 Fix Pack 1 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 2 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 3 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 6 for Linux, UNIX, and Windows

APAR status

• Closed as program error.

Error description

• The stored procedure GET_WRAP_CFG_C and GET_WRAP_CFG_C2 could be
  exploited to read any XML file
  owned by the DB2 fenced ID.  On Windows, the DB2 fenced ID is an
  administrator.
  

Local fix

• The two stored procedures are used by Control Center.  If
  Control Center is not being used then revoke EXECUTE privilege
  on the stored procedures from PUBLIC:
  
  REVOKE EXECUTE ON PROCEDURE SYSPROC.GET_WRAP_CFG_C FROM PUBLIC
  RESTRICT
  REVOKE EXECUTE ON PROCEDURE SYSPROC.GET_WRAP_CFG_C2 FROM PUBLIC
  RESTRICT
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All DB2 systems on all Linux, Unix and Windows platforms at  *
  * service level Version V10.1 GA.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Security Bulletin: XML File Disclosure Vulnerability in  *
  * IBM DB2 GET_WRAP_CFG_C and GET_WRAP_CFG_C2 (CVE-2012-2196):  *
  * http://www-01.ibm.com/support/docview.wss?uid=swg21607618    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to DB2 Version 10.1 Fix Pack 1 or see "Local Fix"    *
  * portion for other suggestions.                               *
  ****************************************************************
  

Problem conclusion

• The complete fix for this problem first appears in DB2 Version
  10.1 Fix Pack 1 and all the subsequent Fix Packs.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IC84614

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 FOR LUW

• Fixed component ID

  DB2FORLUW

Applicable component levels

• R910 PSN

     UP

• R950 PSN

     UP

• R970 PSN

     UP

• R980 PSN

     UP

• RA10 PSN

     UP