CVE-2008-3856

IBM DB2 Universal Database < 8 FP17, < 9.1 FP5, < 9.5 FP1 - Privilege Escalation via db2fmp Process Ownership

Title source: llm
STIX 2.1

Description

The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and attack vectors.

References (11)

Core 11
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31058
Patch vendor-advisory x_refsource_aixapar
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20352
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45140
Patch vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ19155
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29601
Various Sources vendor-advisory x_refsource_aixapar
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20350
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31787
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29784

Scores

EPSS 0.0240
EPSS Percentile 82.3%

Details

CWE
CWE-264
Status published
Products (1)
ibm/db2_universal_database 8 fp1 (50 CPE variants)
Published Aug 28, 2008
Tracked Since Feb 18, 2026