CVE-2009-4326

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-12-16 · updated 2026-06-16
Weakness: CWE-200

Description

The RAND scalar function in the Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1, when the Database Partitioning Feature (DPF) is used, produces "repeating" return values, which might allow attackers to defeat protection mechanisms based on randomization by predicting a value.

Affected products

IBM Db2 for Linux, UNIX and Windows: 9.5, 9.5-fp1, 9.5-fp2, 9.5-fp2a, 9.5-fp3, 9.5-fp3a (+2)

References

http://secunia.com/advisories/37759
http://www-01.ibm.com/support/docview.wss?uid=swg1IC63946
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44872
http://www-01.ibm.com/support/docview.wss?uid=swg21293566
http://www-01.ibm.com/support/docview.wss?uid=swg21412902
http://www.securityfocus.com/bid/37332
http://www.vupen.com/english/advisories/2009/3520
http://secunia.com/advisories/37759

Get alerted when CVE-2009-4326 or the next vulnerability affects your stack