CVE-2009-4331

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 configures the High Availability (HA) scripts with incorrect file-permission and authorization settings, which has unknown impact and local attack vectors.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/37759Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC63581Exploit
http://www-01.ibm.com/support/docview.wss?uid=swg1IC63959Exploit, Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21412902Vendor Advisory
http://www.securityfocus.com/bid/37332
http://www.vupen.com/english/advisories/2009/3520Vendor Advisory
http://secunia.com/advisories/37759Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC63581Exploit
http://www-01.ibm.com/support/docview.wss?uid=swg1IC63959Exploit, Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21293566Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21412902Vendor Advisory
http://www.securityfocus.com/bid/37332
http://www.vupen.com/english/advisories/2009/3520Vendor Advisory

Timeline

Published: Dec 16, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-43325.0db2pd in the Problem Determination component in IBM DB2 9.1 before FP7 and 9.5 before FP5 allows attackers to cause a denial of service (NUL CVE-2009-43337.5The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PA CVE-2009-43344.6The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the CVE-2009-433510.0Multiple unspecified vulnerabilities in bundled stored procedures in the Spatial Extender component in IBM DB2 9.5 before FP5 have unknown i CVE-2009-43364.3Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows re CVE-2009-43377.5SQL injection vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attacker CVE-2009-43387.5SQL injection vulnerability in the Flash SlideShow (slideshow) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL co CVE-2009-43397.5SQL injection vulnerability in the Subscription (mf_subscription) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL CVE-2009-43404.3Cross-site scripting (XSS) vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to i CVE-2009-43417.5SQL injection vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to execute arbitr CVE-2009-43427.5SQL injection vulnerability in the Job Exchange (jobexchange) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL com CVE-2009-43434.3Cross-site scripting (XSS) vulnerability in the Training Company Database (trainincdb) extension 0.4.7 for TYPO3 allows remote attackers to