Privilege Escalation in IBM DB2 High Performance Unload for LUW
CVE-2019-4447

8.4HIGH

Key Information:

Vendor

IBM
Status
Db2 High Performance Unload Load For Luw
Vendor
CVE Published:
26 August 2019

What is CVE-2019-4447?

IBM DB2 High Performance Unload for LUW has a security vulnerability due to a setuid root binary, db2hpum_debug, which improperly trusts the PATH environment variable. A low privilege user can exploit this by modifying the PATH variable to redirect commands to a user-controlled location. This attacker could then induce a crash, triggering execution of malicious commands with root privileges, thereby posing a significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

DB2 High Performance Unload load for LUW 6.1

DB2 High Performance Unload load for LUW 6.1.0.1

DB2 High Performance Unload load for LUW 6.1.0.1IF1

References

http://www.ibm.com/support/docview.wss?uid=ibm10964592
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/163488
vdb-entryx_refsource_XF

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.