CVE-2010-3738

CVE-2010-3738 describes a security vulnerability in IBM DB2 UDB version 9.5 before Fix Pack 6a. The flaw lies in the Security component's logging of AUDIT events, where it incorrectly uses the instance owner's USERID and AUTHID instead of the actual logged-in user's credentials. This misattribution allows remote authenticated users to execute audit administration commands without their actions being properly attributed, hindering detection. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It is exploitable over the network with low attack complexity and requires no authentication (though the description implies authenticated users). The potential impact is a partial integrity compromise, as audit logs become unreliable for tracking administrative actions. There is no evidence of active exploitation, nor are there any known public exploits available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or concern.