IBM Db2 Plain Text Password Logging Vulnerability

Executive Summary

IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5 for Linux, UNIX, and Windows store plain text passwords in trace files. A local attacker could exploit this to access sensitive information.

Useful 0 Not Useful 0

Detection Guidance

Check Db2 trace files for plain text passwords. Search logs in the Db2 diagnostic directory (typically /home/db2inst1/sqllib/db2dump) for entries containing passwords. Use commands like 'grep -r password /path/to/db2dump' or 'find /path/to/db2dump -type f -exec grep -l password {} \;'.

Useful 0 Not Useful 0

Impact Analysis

If you use affected IBM Db2 versions, an attacker with local access could retrieve stored passwords from trace files, potentially gaining unauthorized access to databases or systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations and penalties due to exposed sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Disable trace logging if not required. If trace is needed, review and update Db2 configuration to avoid logging sensitive data. Apply IBM's patch or upgrade to a fixed version (11.5.10 or later, 12.1.6 or later). Restrict access to trace files and audit logs.

Useful 0 Not Useful 0