IC99480: SECURITY: VULNERABILITY IN STORED PROCEDURE INFRASTRUCTURE CAN ALLOW ESCALATION OF PRIVILEGE TO ADMINISTRATOR (CVE-2013-6744).

DB2 Version 10.1 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 6 for Linux, UNIX, and Windows

APAR status

• Closed as program error.

Error description

• There is a security vulnerability in the Stored Procedure
  Infrastructure that will allow a malicious user to gain
  administrator privilege on the server.  This vulnerability is
  only applicable to DB2 on Windows.
  
  To exploit the vulnerability, the DB2 user will need to have
  CREATE_EXTERNAL_ROUTINE privilege which is by default not
  granted to PUBLIC.
  

Local fix

• Revoke CREATE_EXTERNAL_ROUTINE from all users and only grant the
  privilege to trusted users.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All DB2 Servers on Windows platforms at service levels from  *
  * Version 10.1 GA through to Version 10.1 Fix Pack 3.          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * See security bulletin:                                       *
  * http://www-01.ibm.com/support/docview.wss?uid=swg21673947    *
  ****************************************************************
  

Problem conclusion

• See security bulletin:
  http://www-01.ibm.com/support/docview.wss?uid=swg21673947
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IC98849

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 FOR LUW

• Fixed component ID

  DB2FORLUW

Applicable component levels

• RA10 PSN

     UP