CVE-2009-3518

Опубликовано: 01 окт. 2009

Источник: nvd

CVSS2: 9.3

EPSS Низкий

Описание

Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.

Ссылки

http://retrogod.altervista.org/9sg_ibm_uri.html
Exploit
http://secunia.com/advisories/36906
Vendor Advisory
http://www.vupen.com/english/advisories/2009/2792
Vendor Advisory
http://retrogod.altervista.org/9sg_ibm_uri.html
Exploit
http://secunia.com/advisories/36906
Vendor Advisory
http://www.vupen.com/english/advisories/2009/2792
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:installation_manager:*:*:*:*:*:*:*:*

Версия до 1.3.2 (включая)

cpe:2.3:a:ibm:installation_manager:1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:installation_manager:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:installation_manager:1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:installation_manager:1.3.1:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.0786

Низкий

9.3 Critical

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-47gr-pfr8-r958

github

почти 4 года назад