CVE-2007-4275

Related Files

iDEFENSE Security Advisory 2007-08-16.5

Posted Aug 17, 2007

Authored by iDefense Labs | Site idefense.com

iDefense Security Advisory 08.16.07 - Local exploitation of multiple untrusted search path vulnerabilities in IBM Corp.'s DB2 Universal Database could allow attackers to elevate privileges to the superuser. These vulnerabilities exist due to the execution of binaries or loading of libraries within untrusted paths. In each case, the path to a binary or library is generated based on an environment variable that is under attacker control. Additionally, the files to be executed or loaded are located in a directory under attacker control. iDefense confirmed the existence of this vulnerability in version 9.1 Fix Pack 2 of IBM Corp.'s DB2 Universal Database installed on a Linux system. All prior versions, as well as builds for other UNIX-based operating systems, are suspected to be vulnerable.

tags | advisory, local, vulnerability

systems | linux, unix

advisories | CVE-2007-4275

SHA-256 | 5577b8f6a48a6bedfc93172160c097112cad4770e7ab3d4afe01806091868426

Download | Favorite | View