CVE-2009-4334

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-12-16 · updated 2026-06-16
Weakness: CWE-264

Description

The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the STMM log file, which allows local users to cause a denial of service or have unspecified other impact by writing to this file.

Affected products

IBM Db2 for Linux, UNIX and Windows: 9.1, 9.1-fp1, 9.1-fp2, 9.1-fp3, 9.1-fp3a, 9.1-fp4 (+13)

References

http://secunia.com/advisories/37759
http://www-01.ibm.com/support/docview.wss?uid=swg1IC64019
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ48106
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ50355
http://www-01.ibm.com/support/docview.wss?uid=swg21293566
http://www-01.ibm.com/support/docview.wss?uid=swg21412902
http://www.securityfocus.com/bid/37332
http://www.vupen.com/english/advisories/2009/3520

Get alerted when CVE-2009-4334 or the next vulnerability affects your stack