Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1426

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.

Published

2018-03-22T12:29:00.563

Last Modified

2024-11-21T03:59:47.843

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.4 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

4.9

Weaknesses

Type: Primary
CWE-335

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ibm	db2	9.7	Yes
Application	ibm	db2	10.1	Yes
Application	ibm	db2	10.5	Yes
Application	ibm	db2	11.1	Yes
Operating System	linux	linux_kernel	*	No
Application	ibm	db2	9.7	Yes
Application	ibm	db2	10.1	Yes
Application	ibm	db2	10.5	Yes
Application	ibm	db2	11.1	Yes
Operating System	microsoft	windows	-	No

References

http://www.ibm.com/support/docview.wss?uid=swg22013756 Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/105580 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1041012 Third Party Advisory, VDB Entry ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/139071 VDB Entry, Vendor Advisory ([email protected])
http://www.ibm.com/support/docview.wss?uid=swg22013756 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/105580 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1041012 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/139071 VDB Entry, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)