CVE-2009-3699

Published: Oct 15, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.

Affected (31)

Products: Ibm: Aix, Vios

2 products

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Ibm Aix	Version 5.1.0.10
Ibm Aix	Version 5.1
Ibm Aix	Version 5.1l
Ibm Aix	Version 5.2.0.50
Ibm Aix	Version 5.2.0.54
Ibm Aix	Version 5.2.0
Ibm Aix	Version 5.2.2
Ibm Aix	Version 5.2
Ibm Aix	Version 5.2_l
Ibm Aix	Version 5.3.0.20
Ibm Aix	Version 5.3.0
Ibm Aix	Version 5.3.10
Ibm Aix	Version 5.3.7
Ibm Aix	Version 5.3.8
Ibm Aix	Version 5.3.9
Ibm Aix	Version 5.3
Ibm Aix	Version 5.3 sp6
Ibm Aix	Version 5.3_l
Ibm Aix	Version 5.3_ml03
Ibm Aix	Version 5
Ibm Aix	Version 5l
Ibm Aix	Version 6.1.0
Ibm Aix	Version 6.1.1
Ibm Aix	Version 6.1.2
Ibm Aix	Version 6.1.3
Ibm Aix	Version 6.1
Ibm Vios	Up to 2.1.0
Ibm Vios	Version 1.4
Ibm Vios	Version 1.5.0
Ibm Vios	Version 1.5.1
Ibm Vios	Version 1.5.2

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (36)

http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc

Source: cve@mitre.org

Vendor Advisory

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825

Source: cve@mitre.org

Patch

http://secunia.com/advisories/36978

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1022996

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ61628

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ61717

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ62123

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ62237

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ62569

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ62570

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ62571

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=isg1IZ62572

Source: cve@mitre.org

Vendor Advisory

http://www.ibm.com/support/docview.wss?uid=isg1IZ62672

Source: cve@mitre.org

http://www.osvdb.org/58726

Source: cve@mitre.org

http://www.securityfocus.com/bid/36615

Source: cve@mitre.org

ExploitPatch

http://www.vupen.com/english/advisories/2009/2846

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/53681

Source: cve@mitre.org

https://www.immunityinc.com/downloads/immpartners/aixcmsd10092009.tar.gz

Source: cve@mitre.org

http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/36978

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securitytracker.com/id?1022996

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ61628

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ61717

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ62123

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ62237

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ62569

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ62570

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ62571

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=isg1IZ62572

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.ibm.com/support/docview.wss?uid=isg1IZ62672

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/58726

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/36615

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.vupen.com/english/advisories/2009/2846

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/53681

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.immunityinc.com/downloads/immpartners/aixcmsd10092009.tar.gz

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.