CVE-2009-1905

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-03 · updated 2026-06-16
Weakness: CWE-287

Description

The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors.

Affected products

IBM Db2 for Linux, UNIX and Windows: through 8.0; through 9.1; through 9.5; 8.0-fix_pack15, 8.0-fp1, 8.0-fp10, 8.0-fp11, 8.0-fp12, 8.0-fp13 (+7)

References

http://secunia.com/advisories/31787
http://secunia.com/advisories/35235
http://securitytracker.com/id?1022319
http://www-01.ibm.com/support/docview.wss?uid=swg1JR32268
http://www-01.ibm.com/support/docview.wss?uid=swg1JR32272
http://www-01.ibm.com/support/docview.wss?uid=swg1JR32273
http://www-01.ibm.com/support/docview.wss?uid=swg21293566
http://www-01.ibm.com/support/docview.wss?uid=swg21318189
http://www-01.ibm.com/support/docview.wss?uid=swg21386689
http://www.securityfocus.com/bid/35171
http://www.securityfocus.com/bid/36540

Get alerted when CVE-2009-1905 or the next vulnerability affects your stack