CVE-2023-47145
📋 TL;DR
This vulnerability in IBM Db2 for Windows allows a local user to escalate privileges to SYSTEM level using the MSI repair functionality. It affects Db2 versions 10.5, 11.1, and 11.5 on Windows systems. Attackers with initial local access can gain complete system control.
💻 Affected Systems
- IBM Db2 for Windows
- IBM Db2 Connect Server
📦 What is this software?
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM privileges, enabling complete system compromise, data theft, persistence mechanisms, and lateral movement across the network.
Likely Case
Malicious insider or compromised user account escalates to SYSTEM to install malware, steal credentials, or maintain persistence on the system.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated systems with no lateral movement capability.
🎯 Exploit Status
Requires local access but exploitation appears straightforward based on vulnerability description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes as specified in IBM advisory APAR IJ43293
Vendor Advisory: https://www.ibm.com/support/pages/node/7105500
Restart Required: Yes
Instructions:
1. Review IBM advisory APAR IJ43293. 2. Download appropriate fix for your Db2 version. 3. Apply patch following IBM instructions. 4. Restart Db2 services.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit local user access to Db2 Windows systems to only authorized administrators
Monitor MSI Repair Activity
windowsEnable auditing for Windows Installer repair operations on Db2 systems
🧯 If You Can't Patch
- Implement strict least privilege access controls for all local users
- Deploy endpoint detection and response (EDR) to monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Db2 version on Windows systems: db2level command. If version is 10.5, 11.1, or 11.5, system is vulnerable.Check Version:
db2levelVerify Fix Applied:
Verify patch installation via IBM fix verification procedures and confirm db2level shows patched version.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing MSI repair operations on Db2
- Unexpected privilege escalation events
- Db2 service account performing SYSTEM-level actions
Network Indicators:
- None - this is local privilege escalation
SIEM Query:
Windows Event ID 11707 (MSI installer) OR privilege escalation events from Db2 service accounts🔗 References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/270402
- https://security.netapp.com/advisory/ntap-20240307-0003/
- https://www.ibm.com/support/pages/node/7105500
- https://exchange.xforce.ibmcloud.com/vulnerabilities/270402
- https://security.netapp.com/advisory/ntap-20240307-0003/
- https://www.ibm.com/support/pages/node/7105500
