bruiser has discovered a vulnerability in IBM Installation Manager, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error in IBMIM.exe when handling arguments received via an "iim:" URI. This can be exploited to load an arbitrary library from a network share via a specially crafted "-vm" argument.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 1.3.2. Other versions may also be affected.

Solution
The vendor provides scripts that remove the "iim:" handler from the registry. Please see the vendor's advisory for more information.
Further details available in Customer Area

Provided and/or discovered by
nine:situations:group::bruiser

Changelog
Further details available in Customer Area

Original Advisory
IBM (PK21183):
http://www-01.ibm.com/support/docview.wss?uid=swg21407330

bruiser:
http://retrogod.altervista.org/9sg_ibm_uri.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area