CVE-2009-3699

CVSS V2 High 10 CVSS V3 None
Description
Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.
Overview
  • CVE ID
  • CVE-2009-3699
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-10-15T10:30:01
  • Last Modified Date
  • 2017-08-17T01:31:14
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:* 1 OR 2.1.0
cpe:2.3:a:ibm:vios:1.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:vios:1.5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:vios:1.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:vios:1.5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.1.0.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.1l:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.2.0.50:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.2.0.54:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.2_l:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3:sp6:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3.0.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3_l:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5.3_ml03:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:5l:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:6.1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:6.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:6.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:ibm:aix:6.1.3:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 10
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://www.ibm.com/support/docview.wss?uid=isg1IZ62123
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825 Patch
http://www.ibm.com/support/docview.wss?uid=isg1IZ62570
http://www.ibm.com/support/docview.wss?uid=isg1IZ62569
http://www.ibm.com/support/docview.wss?uid=isg1IZ62571
http://www.securityfocus.com/bid/36615 Exploit Patch
http://www.ibm.com/support/docview.wss?uid=isg1IZ61717
http://www.osvdb.org/58726
http://www.vupen.com/english/advisories/2009/2846 Patch Vendor Advisory
http://secunia.com/advisories/36978 Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=isg1IZ62672
http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=isg1IZ61628
http://www.ibm.com/support/docview.wss?uid=isg1IZ62237
http://www.ibm.com/support/docview.wss?uid=isg1IZ62572 Vendor Advisory
https://www.immunityinc.com/downloads/immpartners/aixcmsd10092009.tar.gz
http://securitytracker.com/id?1022996
https://exchange.xforce.ibmcloud.com/vulnerabilities/53681
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-3699
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3699
History
Created Old Value New Value Data Type Notes
2022-05-10 09:00:00 Added to TrackCVE