CVE-2014-0907

Description

Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.

7.2

CVSS

Severity: High

CVSS 2.0 •

EPSS 0.07%

Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com

Affected: n/a n/a

References

Link	Tags
http://seclists.org/fulldisclosure/2014/Jun/7	mailing list
http://www-304.ibm.com/support/docview.wss?uid=swg21676135
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00686	vendor advisory
http://www.ibm.com/support/docview.wss?uid=swg1IT00686
http://www.ibm.com/support/docview.wss?uid=swg21672100	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=isg400001843
http://secunia.com/advisories/59463	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=isg400001841
http://www.ibm.com/support/docview.wss?uid=swg21610582#4	vendor advisory
http://www.securitytracker.com/id/1030670	vdb entry
http://www.securityfocus.com/bid/67617	vdb entry
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00685	vendor advisory
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/
http://www-01.ibm.com/support/docview.wss?uid=swg21680454
http://www.securitytracker.com/id/1030671	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91869	vdb entry
http://secunia.com/advisories/60482	third party advisory
http://secunia.com/advisories/59451	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00687	vendor advisory
http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00684	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT00627	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2014-0907?: CVE-2014-0907 has been scored as a high severity vulnerability.
How to fix CVE-2014-0907?: To fix CVE-2014-0907, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-0907 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2014-0907 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.