PT-2009-5110 · Ibm · Aix

Adriano Lima

+1

·

Publicado

2009-08-10

·

Atualizado

2009-08-11

·

CVE-2009-2727

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions AIX versions 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3
Description The issue is a stack-based buffer overflow in the tt internal realpath function in the ToolTalk library. This occurs when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf, allowing remote attackers to execute arbitrary code via a long XDR-encoded ASCII string to remote procedure 15.
Recommendations For AIX versions 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3, consider disabling the rpc.ttdbserver daemon in /etc/inetd.conf as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-2727

Produtos afetados

Aix