CVE-2007-6046

Vulnerability

An unspecified vulnerability exists in several setuid binaries shipped with IBM DB2 UDB version 9.1 prior to Fix Pack 4 [2]. The exact binaries are not disclosed, but the flaw allows a local user to create directories as the root user through the abuse of symbolic links [2]. This issue does not affect Windows systems [2].

Exploitation

An attacker must have local user access to the system [2]. By crafting symbolic links in a location that the vulnerable setuid binary will follow during its operation, the attacker can cause the binary to create a directory owned by root [2]. No additional authentication or user interaction beyond local shell access is required.

Impact

Successful exploitation enables a local attacker to create arbitrary directories as root [2]. While this does not directly provide code execution or file overwrite, it can be leveraged for further privilege escalation or to disrupt system operations by placing directories in sensitive paths.

Mitigation

IBM released the fix in DB2 UDB version 9.1 Fix Pack 4 [2]. All subsequent fix packs (5 through 12) also include the fix [2]. No workaround is documented. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.