CVE-2008-1998 Path traversal in n/a

High 8.5 Published 28 Apr 2008 Updated 7 Aug 2024

Authenticated remote attackers can overwrite arbitrary files in IBM DB2 on Windows via the NNSTAT procedure's log file parameter.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2008-1998?

CVE-2008-1998 is a high-severity path traversal vulnerability in Ibm Db2, published on 28 Apr 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter.

Weakness: CWE-264

Which versions are affected by CVE-2008-1998?

It affects 1 product.

Products include Ibm Db2.

How do I fix CVE-2008-1998?

No fix has been published for CVE-2008-1998 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2008-1998 being exploited?

There is no known exploitation of CVE-2008-1998 in the wild and no public exploit code.

All Ibm Db2 vulnerabilities

Sources

Also known as GHSA-c95g-rpjx-pm4h.