CVE-2010-3475
IBM DB2 9.7 - Authenticated Privilege Bypass via Dynamic SQL Cache
Title source: llmDescription
IBM DB2 9.7 before FP3 does not properly enforce privilege requirements for execution of entries in the dynamic SQL cache, which allows remote authenticated users to bypass intended access restrictions by leveraging the cache to execute an UPDATE statement contained in a compiled compound SQL statement.
References (9)
Core 9
Core References
Various Sources x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21446455
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC70406
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/43291
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2425
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/61873
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/41444
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/68122
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14609
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1024458
Scores
EPSS
0.0284
EPSS Percentile
85.2%
Details
CWE
CWE-264
Status
published
Products (3)
ibm/db2
9.7
ibm/db2
9.7.0.1
ibm/db2
9.7.0.2
Published
Sep 20, 2010
Tracked Since
Feb 18, 2026