IBM Db2 for Linux, UNIX and Windows information disclosure

Vulnerability

IBM Db2 for Linux, UNIX, and Windows versions 10.5, 11.1, and 11.5 (all fix pack levels) are affected by an information disclosure vulnerability due to improper privilege management [1]. The flaw is triggered when a specially crafted table access is performed, allowing an authenticated low-privileged user to bypass intended access controls.

Exploitation

An attacker must have network access and a valid low-privileged database account (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) [1]. The attack complexity is high, requiring the attacker to craft a specific table access pattern. No user interaction is needed. The exact sequence of steps is not publicly detailed, but the condition is reachable through standard SQL operations with a maliciously designed query.

Impact

Successful exploitation results in high confidentiality impact, allowing the attacker to read sensitive information from the database that should be restricted [1]. Integrity and availability are not affected. The attacker gains unauthorized access to data at the privilege level of the authenticated user, potentially exposing customer records, credentials, or other confidential data.

Mitigation

IBM has released special builds containing the interim fix for each affected release: V10.5 FP11, V11.1.4 FP7, and V11.5.8 [1]. These builds are available from IBM Fix Central under APAR DT173489. Customers on any fix pack level of the affected versions can apply the corresponding special build to remediate the vulnerability. No workarounds are documented, and the issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.