CVE-2009-3473

Summary

IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege for the SET SESSION AUTHORIZATION statement, which has unspecified impact and remote attack vectors.

Impact & exploitability

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

• NVD record
• http://secunia.com/advisories/36890Advisory
• http://osvdb.org/58479
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55883
• http://www-01.ibm.com/support/docview.wss?uid=swg21403619
• http://www.securityfocus.com/bid/36540