cve-2018-1409
Vulnerability from cvelistv5
Published
2018-02-19 14:00
Modified
2024-09-16 19:20
Severity ?
EPSS score ?
Summary
IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708.
References
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | IBM | Client Application Access |
Version: 1.0.0.1 Version: 1.0.1 Version: 1.0.1.2 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:59:39.073Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010766"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/138708"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010767"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Client Application Access",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.0.0.1"
},
{
"status": "affected",
"version": "1.0.1"
},
{
"status": "affected",
"version": "1.0.1.2"
}
]
},
{
"product": "Notes",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.5.3.6"
},
{
"status": "affected",
"version": "8.5.1.5"
},
{
"status": "affected",
"version": "8.5.2.4"
},
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.0.1.9"
}
]
}
],
"datePublic": "2018-02-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-19T13:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010766"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/138708"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010767"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2018-02-13T00:00:00",
"ID": "CVE-2018-1409",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Client Application Access",
"version": {
"version_data": [
{
"version_value": "1.0.0.1"
},
{
"version_value": "1.0.1"
},
{
"version_value": "1.0.1.2"
}
]
}
},
{
"product_name": "Notes",
"version": {
"version_data": [
{
"version_value": "8.5.3.6"
},
{
"version_value": "8.5.1.5"
},
{
"version_value": "8.5.2.4"
},
{
"version_value": "9.0"
},
{
"version_value": "9.0.1.9"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=swg22010766",
"refsource": "CONFIRM",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010766"
},
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/138708",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/138708"
},
{
"name": "http://www.ibm.com/support/docview.wss?uid=swg22010767",
"refsource": "CONFIRM",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22010767"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1409",
"datePublished": "2018-02-19T14:00:00Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T19:20:33.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2018-1409\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2018-02-19T14:29:00.583\",\"lastModified\":\"2024-11-21T03:59:45.860\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708.\"},{\"lang\":\"es\",\"value\":\"IBM Notes Diagnostics (IBM Client Application Access e IBM Notes) podr\u00eda permitir que un usuario local ejecute comandos en el sistema. Esto se logra al manipular una l\u00ednea de comandos enviada mediante el IPC de la memoria compartida, la cual podr\u00eda ser forzada por el atacante para que ejecute un archivo ejecutable. IBM X-Force ID: 138708.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":7.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":3.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:notes:8.5.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72683B62-0BB1-4FB2-8661-447FCF535885\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:notes:8.5.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FBB9A06-5600-4174-A4A5-C85059DDE4B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:notes:8.5.3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"99D14E8F-303F-4BE3-9BC4-0646B71A8660\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:notes:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9ABFF78-233F-4413-AE17-C290D50E2E87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:notes:9.0.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0946E0E-508F-49D0-BBA8-8CB725BDD3D9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:client_application_access:1.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8173749-67C8-46D1-8505-200ADF7A70D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:client_application_access:1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00FCFCE2-5023-4519-B42A-F9B7F818BF44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:client_application_access:1.0.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F62A11E-6224-4BC8-A46B-74A44D2F6A41\"}]}]}],\"references\":[{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg22010766\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg22010767\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/138708\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"VDB Entry\"]},{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg22010766\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg22010767\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/138708\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"VDB Entry\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.