Vulnerability Details : CVE-2009-4325
Potential exploit
The Client Interfaces component in IBM DB2 8.2 before FP18, 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not validate an unspecified pointer, which allows attackers to overwrite "external memory" via unknown vectors, related to a missing "check for null pointers."
Vulnerability category: Input validation
Products affected by CVE-2009-4325
- cpe:2.3:a:ibm:db2:9.1:fp1:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp3:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp2:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp1:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp5:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp6:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp4:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp2:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp3:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp9:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp10:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp15:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp7:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp3a:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp4:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp11:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp12:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp13:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp14:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp8:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp16:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp4a:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.5:fp1:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp5:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp6:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.5:fp2:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.5:fp3:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp6a:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.1:fp7:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.5:fp2a:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.5:fp3a:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:9.5:fp3b:*:*:*:*:*:*
- cpe:2.3:a:ibm:db2:8.2:fp17:*:*:*:*:*:*
Threat overview for CVE-2009-4325
Top countries where our scanners detected CVE-2009-4325
Top open port discovered on systems with this issue
523
IPs affected by CVE-2009-4325 52
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2009-4325!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2009-4325
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-4325
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:P |
10.0
|
4.9
|
NIST |
CWE ids for CVE-2009-4325
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-4325
-
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT
Patch
-
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IC64702
-
http://www.vupen.com/english/advisories/2009/3520
Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21412902
-
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT
-
http://www-01.ibm.com/support/docview.wss?uid=swg1LI72709
Exploit;Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg1LI74500
Exploit;Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21293566
Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/37332
-
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT
-
http://www-01.ibm.com/support/docview.wss?uid=swg1LI74504
Jump to