CVE-2017-1677 Deserialization in DB2 for Linux, UNIX and Windows

High 7.4 Published 22 Mar 2018 Updated 17 Sep 2024

The IBM DB2 JDBC driver deserializes untrusted data from a temporary file, allowing attackers to execute arbitrary code via object injection.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-1677?

CVE-2017-1677 is a high-severity unsafe deserialization vulnerability in Ibm Db2, published on 22 Mar 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999.

Weakness: CWE-502

Which versions are affected by CVE-2017-1677?

It affects 1 product.

Products include Ibm Db2.

How do I fix CVE-2017-1677?

No fix has been published for CVE-2017-1677 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-1677 being exploited?

There is no known exploitation of CVE-2017-1677 in the wild and no public exploit code.

All Ibm Db2 vulnerabilities

Sources

Also known as GHSA-2cm6-r3gm-8w87.