Unscored severity · published Sep 10, 2009
CVE-2009-3160
IBM WebSphere MQ 6.x through 6.0.2.7, 7.0.0.0, 7.0.0.1, 7.0.0.2, and 7.0.1.0, when read ahead or asynchronous message consumption is enabled, allows attackers to have an…
–
CVSS
1.5%
EPSS
No
On KEV
Description
IBM WebSphere MQ 6.x through 6.0.2.7, 7.0.0.0, 7.0.0.1, 7.0.0.2, and 7.0.1.0, when read ahead or asynchronous message consumption is enabled, allows attackers to have an unspecified impact via unknown vectors, related to a "memory overwrite" issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Websphere MQ · Ibm
6; 6.0; 6.0.0.0; 6.0.1.0; 6.0.1.1; 6.0.2.0; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3160
Vendor Advisory
http://secunia.com/advisories/36647
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg24024153
www-1.ibm.com
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ56259
www.securityfocus.com
http://www.securityfocus.com/bid/36310
Patch
http://www.vupen.com/english/advisories/2009/2578
More from Websphere MQ
9.8
CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
8.6
CVE-2017-1145
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource…
8.1
CVE-2017-1337
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text
7.8
CVE-2019-4078
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on…
7.8
CVE-2018-1998
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges