CVE-2009-1291

Published: Apr 30, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product Family (aka RTworks) before 4.0.5, and Enterprise Message Service (EMS) 4.0.0 through 5.1.1, as used in SmartSockets Server and RTworks Server (aka RTserver), SmartSockets client libraries and add-on products, RTworks libraries and components, EMS Server (aka tibemsd), SmartMQ, iProcess Engine, ActiveMatrix products, and CA Enterprise Communicator, allows remote attackers to execute arbitrary code via "inbound data," as demonstrated by requests to the UDP interface of the RTserver component, and data injection into the TCP stream to tibemsd.

Affected (13)

Products: Tibco: Enterprise Message Service, Rtworks, Smartsockets, Smartsockets Rtserver

4 products

Enterprise Message Service

Smartsockets Rtserver

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Tibco Enterprise Message Service	Up to 5.1.1
Tibco Enterprise Message Service	Version 4.0.0
Tibco Enterprise Message Service	Version 4.1.0
Tibco Enterprise Message Service	Version 4.2.0
Tibco Enterprise Message Service	Version 4.3.0
Tibco Enterprise Message Service	Version 4.4.1
Tibco Enterprise Message Service	Version 4.4.2
Tibco Rtworks	Version 4.0.3
Tibco Rtworks	Version 4.0.4
Tibco Smartsockets	Version 6.8.0
Tibco Smartsockets	Version 6.8.1
Tibco Smartsockets Rtserver	Up to 6.8.1
Tibco Smartsockets Rtserver	Version 6.8.0

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (24)

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=785

Source: cve@mitre.org

http://secunia.com/advisories/34911

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1022129

Source: cve@mitre.org

http://www.harmonysecurity.com/blog/2009/04/tibco-smartsockets-stack-buffer.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/34754

Source: cve@mitre.org

http://www.tibco.com/multimedia/security_advisory_ems_tcm8-7558.txt

Source: cve@mitre.org

Vendor Advisory

http://www.tibco.com/multimedia/security_advisory_rtworks_tcm8-7559.txt

Source: cve@mitre.org

Vendor Advisory

http://www.tibco.com/multimedia/security_advisory_smartsockets_tcm8-7560.txt

Source: cve@mitre.org

Vendor Advisory

http://www.tibco.com/services/support/advisories/default.jsp

Source: cve@mitre.org

PatchVendor Advisory

http://www.tibco.com/services/support/advisories/smartsockets-sspfm-ems_advisory_20090428.jsp

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2009/1198

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/50214

Source: cve@mitre.org

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=785

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34911

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securitytracker.com/id?1022129

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.harmonysecurity.com/blog/2009/04/tibco-smartsockets-stack-buffer.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/34754

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.tibco.com/multimedia/security_advisory_ems_tcm8-7558.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.tibco.com/multimedia/security_advisory_rtworks_tcm8-7559.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.tibco.com/multimedia/security_advisory_smartsockets_tcm8-7560.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.tibco.com/services/support/advisories/default.jsp

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.tibco.com/services/support/advisories/smartsockets-sspfm-ems_advisory_20090428.jsp

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2009/1198

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/50214

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.