CVE-2009-3518

2009-10-0115:30:00

CWE-94

mitre

web.nvd.nist.gov

ibm

ibmim.exe

argument injection vulnerability

remote attackers

dll files

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.7

Confidence

Low

EPSS

0.019

Percentile

88.7%

JSON

Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.

Affected configurations

Nvd

Node

ibminstallation_managerRange≤1.3.2

ibminstallation_managerMatch1.0

ibminstallation_managerMatch1.2.1

ibminstallation_managerMatch1.3.0

ibminstallation_managerMatch1.3.1

VendorProductVersionCPE
ibminstallation_manager*cpe:2.3:a:ibm:installation_manager:*:*:*:*:*:*:*:*
ibminstallation_manager1.0cpe:2.3:a:ibm:installation_manager:1.0:*:*:*:*:*:*:*
ibminstallation_manager1.2.1cpe:2.3:a:ibm:installation_manager:1.2.1:*:*:*:*:*:*:*
ibminstallation_manager1.3.0cpe:2.3:a:ibm:installation_manager:1.3.0:*:*:*:*:*:*:*
ibminstallation_manager1.3.1cpe:2.3:a:ibm:installation_manager:1.3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	installation_manager	*	cpe:2.3:a:ibm:installation_manager::::::::
ibm	installation_manager	1.0	cpe:2.3:a:ibm:installation_manager:1.0:::::::*
ibm	installation_manager	1.2.1	cpe:2.3:a:ibm:installation_manager:1.2.1:::::::*
ibm	installation_manager	1.3.0	cpe:2.3:a:ibm:installation_manager:1.3.0:::::::*
ibm	installation_manager	1.3.1	cpe:2.3:a:ibm:installation_manager:1.3.1:::::::*