Login Sign Up

CVE-2021-29825

7.5 HIGH

📋 TL;DR

IBM Db2 databases can leak sensitive information when administrators use the ADMIN_CMD procedure with LOAD or BACKUP commands. This affects Db2 for Linux, UNIX, Windows, and Db2 Connect Server installations. Attackers could potentially access confidential data through these administrative operations.

💻 Affected Systems

Products:
  • IBM Db2 for Linux, UNIX and Windows
  • IBM Db2 Connect Server
Versions: Multiple versions up to and including 11.5.5.0
Operating Systems: Linux, UNIX, Windows
Default Config Vulnerable: ⚠️ Yes
Notes: Requires ADMIN_CMD procedure access; typically affects systems where administrators use LOAD or BACKUP operations.

📦 What is this software?

Db2 by Ibm

View all CVEs affecting Db2 →

Db2 by Ibm

View all CVEs affecting Db2 →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full database information disclosure including sensitive customer data, credentials, or proprietary information exposed to unauthorized parties.

🟠

Likely Case

Partial information disclosure of database contents, potentially exposing sensitive tables or configuration details.

🟢

If Mitigated

Minimal impact with proper access controls limiting ADMIN_CMD usage to trusted administrators only.

🌐 Internet-Facing: MEDIUM - While ADMIN_CMD typically requires authentication, exposed Db2 instances could be targeted by authenticated attackers.
🏢 Internal Only: HIGH - Internal attackers with database access could exploit this to exfiltrate sensitive information.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires database administrator privileges or compromised admin credentials to execute ADMIN_CMD.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply fix packs as specified in IBM advisory

Vendor Advisory: https://www.ibm.com/support/pages/node/6489499

Restart Required: Yes

Instructions:

1. Review IBM advisory for specific fix packs. 2. Apply appropriate fix pack for your Db2 version. 3. Restart Db2 services. 4. Verify patch application.

🔧 Temporary Workarounds

Restrict ADMIN_CMD Access

all

Limit ADMIN_CMD procedure execution to only essential, trusted administrators.

REVOKE EXECUTE ON PROCEDURE SYSPROC.ADMIN_CMD FROM PUBLIC;
GRANT EXECUTE ON PROCEDURE SYSPROC.ADMIN_CMD TO trusted_admins_only;

Monitor ADMIN_CMD Usage

all

Implement logging and monitoring for ADMIN_CMD procedure executions.

-- Configure audit policies for ADMIN_CMD
AUDIT PROCEDURE SYSPROC.ADMIN_CMD;

🧯 If You Can't Patch

  • Implement strict access controls to limit who can execute ADMIN_CMD procedures
  • Monitor and audit all ADMIN_CMD usage for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check Db2 version against affected versions list in IBM advisory; verify if ADMIN_CMD is accessible.

Check Version:

db2level | grep 'Product name'

Verify Fix Applied:

Confirm applied fix pack version matches or exceeds patched versions in IBM advisory.

📡 Detection & Monitoring

Log Indicators:

  • Unusual ADMIN_CMD executions
  • LOAD or BACKUP operations from unexpected sources
  • Failed ADMIN_CMD access attempts

Network Indicators:

  • Database connections followed by ADMIN_CMD procedure calls
  • Unusual data export patterns

SIEM Query:

source="db2_audit_logs" AND (procedure="ADMIN_CMD" OR operation="LOAD" OR operation="BACKUP")

📊 Metadata

CVE ID: CVE-2021-29825
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: September 16, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON