PT-2009-5958 · Ibm · Ibm Aix+2

Rodrigo Rubira Branco · Published 2009-10-15 · Updated 2017-08-17 · CVE-2009-3699

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM AIX versions 5.x through 5.3.10 IBM AIX versions 6.x through 6.1.3 VIOS versions 2.1 and earlier

Description A stack-based buffer overflow issue exists in the libcsa.a library, which is part of the calendar daemon. This issue can be exploited by remote attackers who send a long XDR string in the first argument to procedure 21 of rpc.cmsd, allowing them to execute arbitrary code.

Recommendations For IBM AIX versions 5.x through 5.3.10, update to a version later than 5.3.10 to resolve the issue. For IBM AIX versions 6.x through 6.1.3, update to a version later than 6.1.3 to resolve the issue. For VIOS versions 2.1 and earlier, update to a version later than 2.1 to resolve the issue. As a temporary workaround, consider restricting access to the rpc.cmsd procedure 21 to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-3699

Affected Products

Ibm Aix

Vios

Libcsa.A

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/aix/rpc_cmsd_opcode21.rb · Exploit
• 🔥 http://securityfocus.com/bid/36615 · Exploit
• 🔥 https://exploit-db.com/exploits/16929 · Exploit
• http://ibm.com/support/docview.wss?uid=isg1IZ62571 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IZ62572 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IZ62672 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IZ62123 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IZ62570 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IZ62237 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IZ61628 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IZ61717 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2846 · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-3699 · Security Note
• http://ibm.com/support/docview.wss?uid=isg1IZ62569 · Vendor Advisory