CVE-2009-3473 IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege for the SET SESSION AUTHORIZATION statement, which has unspecified impact and remote attack vectors.
HighCVSS 10.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege for the SET SESSION AUTHORIZATION statement, which has unspecified impact and remote attack vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm db2 | = 9.1-fp1 | No fix listed |
| ibm db2 | = 9.1-fp2 | No fix listed |
| ibm db2 | = 9.1-fp3 | No fix listed |
| ibm db2 | = 9.1-fp4 | No fix listed |
| ibm db2 | = 9.1-fp5 | No fix listed |
| ibm db2 | = 9.1-fp6 | No fix listed |
| ibm db2 | = 9.1-fp7 | No fix listed |
References
- 58479 vdb-entry
- 36890 third-party-advisory vendor-advisory
- IZ55883 vendor-advisory
- www-01.ibm.com
- 36540 vdb-entry