CVE-2011-0489

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the Advanced Multithreaded Server, as demonstrated by commands that are ordinarily sent by the (a) ookillls and (b) oostopams applications. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/70424
http://secunia.com/advisories/42901Vendor Advisory
http://www.exploit-db.com/exploits/15988Exploit
http://www.kb.cert.org/vuls/id/782567US Government Resource
http://www.securityfocus.com/bid/45803
http://www.vupen.com/english/advisories/2011/0127Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/64699
http://osvdb.org/70424
http://secunia.com/advisories/42901Vendor Advisory
http://www.exploit-db.com/exploits/15988Exploit
http://www.kb.cert.org/vuls/id/782567US Government Resource
http://www.securityfocus.com/bid/45803
http://www.vupen.com/english/advisories/2011/0127Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/64699

Timeline

Published: Jan 18, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-04905.0Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha makes calls to Libevent within Libevent log handlers, which might allow remote attacke CVE-2011-04915.0The tor_realloc function in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not validate a certain size value during memory alloc CVE-2011-04925.0Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (assertion failure and daemon exi CVE-2011-04935.0Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha might allow remote attackers to cause a denial of service (assertion failure and daemo CVE-2011-04945.0Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 5.1 before 5.1.0.39-TIV-AWS-IF0040, 6.0 before 6.0.CVE-2011-04956.0Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.CVE-2011-049610.0Unspecified vulnerability in Sybase EAServer 5.x and 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), a CVE-2011-04977.8Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), a CVE-2011-04989.3Stack-based buffer overflow in Nokia Multimedia Player 1.00.55.5010, and possibly other versions, allows user-assisted remote attackers to c CVE-2011-04999.3Buffer overflow in VideoSpirit Pro 1.6.8.1 and possibly earlier versions, and VideoSpirit Lite 1.4.0.1 and possibly other versions, allows u CVE-2011-05009.3Buffer overflow in VideoSpirit Pro 1.6.8.1, 1.68, and earlier; and VideoSpirit Lite 1.4.0.1 and possibly other versions; allows user-assiste CVE-2011-05019.3Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted re