PT-2012-2398 · Ibm · Ibm Cognos Tm1

Published 2012-05-04 · Updated 2017-08-29 · CVE-2012-0202

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Cognos TM1 versions 9.4.x through 9.5.x before 9.5.2 FP2

Description The issue is related to multiple stack-based buffer overflows in the tm1admsd.exe component of the Admin Server. This can be exploited by remote attackers using crafted data, potentially leading to a denial of service (causing the daemon to crash) or possibly allowing the execution of arbitrary code.

Recommendations For versions 9.4.x through 9.5.x before 9.5.2 FP2, update to version 9.5.2 FP2 or later to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-0202

ZDI-12-101

Affected Products

Ibm Cognos Tm1

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/ibm_cognos_tm1admsd_bof.rb · Exploit
• 🔥 https://exploit-db.com/exploits/23969 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-12-101 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21590314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0202 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg24032165 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg24032164 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg24032166 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73182 · Note