Unscored severity · published Oct 13, 2009
CVE-2009-3691
Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code…
–
CVSS
7%
EPSS
No
On KEV
Description
Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize, and possibly (2) ProtoSize and (3) ServerSize, field that triggers a stack-based buffer overflow involving a crafted HostList field. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.0% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Informix Client Sdk · Ibm
3.0; 3.50 · source: NVD
IC
Informix Connect Runtime · Ibm
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3691
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3691
Exploit
http://retrogod.altervista.org/9sg_ibm_setnet32.html
Vendor Advisory
http://secunia.com/advisories/36949
securitytracker.com
http://securitytracker.com/id?1022985
www.osvdb.org
http://www.osvdb.org/58530
www.securityfocus.com
http://www.securityfocus.com/bid/36588
Vendor Advisory
http://www.vupen.com/english/advisories/2009/2834
More from Informix Client Sdk
–
CVE-2006-5663
IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 use insecure permissions for installation scripts, which…
–
CVE-2006-5664
The installation script in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 allows local users to "compromise…