CVE-2009-3518: Code Injection
Published Oct 1, 2009
·Updated
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
Affected Software
5 affected components
IBM Installation Manager=1.0
IBM Installation Manager=1.2.1
IBM Installation Manager=1.3.0
IBM Installation Manager=1.3.1
IBM Installation Manager<=1.3.2
Event History
Oct 1, 2009
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-3518?
CVE-2009-3518 is classified as a medium severity vulnerability due to the risk of arbitrary code execution.
2
How do I fix CVE-2009-3518?
To fix CVE-2009-3518, update IBM Installation Manager to version 1.3.3 or later.
3
What systems are affected by CVE-2009-3518?
CVE-2009-3518 affects IBM Installation Manager versions 1.0 through 1.3.2.
4
What type of vulnerability is CVE-2009-3518?
CVE-2009-3518 is an argument injection vulnerability in the iim: URI handler.
5
What can an attacker do with CVE-2009-3518?
An attacker exploiting CVE-2009-3518 can load arbitrary DLL files via the -vm option.