CVE-2007-3676: Critical – IBM DB2 Universal Database (UDB) Administration Server (DAS) 8 before

CWE Weakness Definitions

CWE-399: Resource Management Errors

Broad class covering failures in managing system resources such as memory, file handles, and connections.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2008. A critical vulnerability affects Ibm systems (CVE-2007-3676). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2008-GLOBAL-018490-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2007-3676?

This vulnerability was disclosed in 2008. A critical vulnerability affects Ibm systems (CVE-2007-3676). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

What is the CVSS score for CVE-2007-3676?

CVE-2007-3676 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 4.3%.

Is CVE-2007-3676 actively exploited?

No confirmed active exploitation of CVE-2007-3676 as of 2026-09-25.

How do I remediate CVE-2007-3676?

Priority: MEDIUM.

What systems are affected by CVE-2007-3676?

CVE-2007-3676 affects Ibm Db2.

Vulnerability Details

CVE ID	`CVE-2007-3676`
BSID	`BS-2008-GLOBAL-018490-C` BreachSpider Global ID
CVSS Vector	`AV:N/AC:L/Au:N/C:C/I:C/A:C`
Published	2008-02-13
Last Modified	2026-06-16
ICS Relevance	0%
Weakness (CWE)	Resource Management Errors
Source	NVD

Official Description

IBM DB2 Universal Database (UDB) Administration Server (DAS) 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory corruption or other invalid memory access. NOTE: this might be the same issue as CVE-2008-0698.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: IBM DB2 Universal Database (UDB) Administration Server (DAS) 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory corruption or other invalid memory access. NOTE: this might be the same issue as CVE-2008-0698. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation Likelihood: LOW

Affected Products

Vendor	Product	Affected Versions
Ibm	Db2	`≤ 9.0`

Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 6820 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`94cd881d80bd1e7c2f11e9aac8dec3e3ff5348d18c0997f280f3f718d0145fe5fbaf36090bd557bb8fd084cdd3001a805c56dc8f88b36944fdb3a099a75fa5e4`

Related CVEs affecting Ibm

CVE-2009-3032 10.0 Integer overflow in kvolefio.dll 8.5.0.8339 and 10.5.0.0 in the Autonomy KeyV... CVE-1999-1119 10.0 FTP installation script anon.ftp in AIX insecurely configures anonymous FTP, ... CVE-1999-0099 10.0 Buffer overflow in syslog utility allows local or remote attackers to gain ro... CVE-1999-0042 10.0 Buffer overflow in University of Washington's implementation of IMAP and POP servers. CVE-1999-0097 10.0 The AIX FTP client can be forced to execute commands from a malicious server ...

View all Ibm CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →