CVE-2008-1998

Severity: high (CVSS 8.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-28 · updated 2026-06-16
Weakness: CWE-264

Description

The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter.

Affected products

IBM Db2 for Linux, UNIX and Windows: 8.0-fp1, 8.0-fp10, 8.0-fp11, 8.0-fp12, 8.0-fp13, 8.0-fp14 (+22)

References

http://secunia.com/advisories/29022
http://secunia.com/advisories/29784
http://securityreason.com/securityalert/3840
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06976
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06977
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ10776
http://www.appsecinc.com/resources/alerts/db2/2008-03.shtml
http://www.securityfocus.com/archive/1/491073/100/0/threaded
http://www.securityfocus.com/bid/28836
https://exchange.xforce.ibmcloud.com/vulnerabilities/41960
http://secunia.com/advisories/29022
http://secunia.com/advisories/29784

Get alerted when CVE-2008-1998 or the next vulnerability affects your stack