Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2003-1051 — Use of Externally-Controlled Format String in IBM DB2

6 documents4 sources

Severity

7.2HIGHNVD

EPSS

0.1%

top 84.49%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

IBM DB2

Timeline

PublishedSep 28

Latest updateApr 29

Description

Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

▶NVDibm/db29.0

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

GHSA

GHSA-rj45-5jmh-9g9j: Multiple format string vulnerabilities in IBM DB2 Universal Database 8↗2022-04-29

▶

CVEList

CVE-2003-1051: Multiple format string vulnerabilities in IBM DB2 Universal Database 8↗2004-08-20

▶

💥Exploits & PoCs

Exploit-DB

IBM DB2 - 'db2govd' Format String Arbitrary Code Execution↗2003-11-07

▶

Exploit-DB

IBM DB2 - 'db2start' Format String Arbitrary Code Execution↗2003-11-07

▶

Exploit-DB

IBM DB2 - 'db2stop' Format String Arbitrary Code Execution↗2003-11-07

▶