CVE-2009-3691: Buffer Overflow

Published Oct 13, 2009

Updated

Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize, and possibly (2) ProtoSize and (3) ServerSize, field that triggers a stack-based buffer overflow involving a crafted HostList field. NOTE: some of these details are obtained from third party information.

Affected Software

3 affected components

IBM Informix Client SDK=3.0

IBM Informix Client SDK=3.50

IBM Informix Connect Runtime=3.0

Event History

Oct 13, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3691?

CVE-2009-3691 is considered to have a high severity due to the potential for remote code execution.

How do I fix CVE-2009-3691?

To fix CVE-2009-3691, update the IBM Informix Client SDK and Informix Connect Runtime to the latest version that resolves this vulnerability.

What are the impacted software versions for CVE-2009-3691?

CVE-2009-3691 affects IBM Informix Client SDK versions 3.0 and 3.50, as well as Informix Connect Runtime version 3.0.

How can CVE-2009-3691 be exploited?

CVE-2009-3691 can be exploited by remote attackers through a specially crafted .nfx file that triggers an integer overflow.

What type of vulnerability is CVE-2009-3691?

CVE-2009-3691 is categorized as an integer overflow vulnerability that can lead to arbitrary code execution.