PT-2009-5950 · Ibm · Informix Connect Runtime+1

Publicado 2009-10-13 · Atualizado 2017-08-17 · CVE-2009-3691

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Informix Client SDK versions 3.0 through 3.50 Informix Connect Runtime versions 3.x

Description The issue is related to multiple integer overflows in the setnet32.exe file, which can be exploited by remote attackers to execute arbitrary code. This can be achieved by using a crafted .nfx file with specific field values, such as HostSize, ProtoSize, and ServerSize, that trigger a stack-based buffer overflow involving a crafted HostList field.

Recommendations For IBM Informix Client SDK versions 3.0 through 3.50, update to a version that fixes the integer overflows in setnet32.exe. For Informix Connect Runtime versions 3.x, update to a version that fixes the integer overflows in setnet32.exe. As a temporary workaround, consider restricting access to the setnet32.exe file to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-3691

Produtos afetados

Ibm Informix Client Sdk

Informix Connect Runtime

Referências · 9

• 🔥 http://retrogod.altervista.org/9sg_ibm_setnet32.html · Exploit
• 🔥 https://exploit-db.com/exploits/10070 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53644 · Nota
• http://vupen.com/english/advisories/2009/2834 · Aviso do Fabricante
• http://secunia.com/advisories/36949 · Aviso do Fabricante
• http://securitytracker.com/id?1022985 · Nota
• http://osvdb.org/58530 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3691 · Nota de Segurança
• http://securityfocus.com/bid/36588 · Nota