CVE-2009-2727
published 2009-08-10CVE-2009-2727: Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0…
PriorityP264critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
26.75%
97.8th percentile
Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3, when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf, allows remote attackers to execute arbitrary code via a long XDR-encoded ASCII string to remote procedure 15.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x7f\xff\xfb\x78 (repeated 1920 times, NOP sled)
- →Detect exploitation attempts by monitoring for unusually large XDR-encoded strings sent to SunRPC program 100083 (rpc.ttdbserverd) procedure 15 over TCP. ↗
- →Look for the PPC NOP sled byte pattern 0x7FFFFB78 repeated in large RPC payloads destined for rpc.ttdbserverd. ↗
- →Monitor /etc/inetd.conf for the presence of rpc.ttdbserver; the vulnerability is only exploitable when this daemon is enabled. ↗
- →Alert on large RPC calls to SunRPC program 100083 procedure 15 over TCP containing repetitive 4-byte block patterns consistent with return-address bruteforcing (step size 1024 bytes). ↗
- ·The exploit only works when rpc.ttdbserverd is explicitly enabled in /etc/inetd.conf; disabling it removes the attack surface entirely. ↗
- ·The Metasploit module uses bruteforce return-address stepping, meaning multiple connection attempts with varying Ret values will be observed before a successful exploit; single-attempt blocking may be insufficient. ↗
- ·Return addresses and stack offsets differ per AIX minor version (5.3.7–5.3.10, 6.1.0–6.1.4); detection signatures based on specific return address values will only cover known targets. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
ToolTalk - rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX) (Metasploit)
exploitdb·2010-11-11
CVE-2009-2727 ToolTalk - rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX) (Metasploit)
ToolTalk - rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX) (Metasploit)
---
##
# $Id: rpc_ttdbserverd_realpath.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)',
'Description' => %q{
This module exploits a buffer overflow vulnerability in _tt_internal_realpath
function of the ToolTalk database server (rpc.ttdbserverd).
},
'Author' =>
[
'Adriano Lima ',
'ramon'
],
'Version' => '$Revision: 10998 $',
'Platform' => [ 'aix' ],
'
Metasploit
ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)
metasploit
ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)
ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)
This module exploits a buffer overflow vulnerability in _tt_internal_realpath function of the ToolTalk database server (rpc.ttdbserverd).
No writeups or analysis indexed.
http://aix.software.ibm.com/aix/efixes/security/libtt_advisory.aschttp://risesecurity.org/advisories/RISE-2009001.txthttp://secunia.com/advisories/35505http://www.ibm.com/support/docview.wss?uid=isg1IZ52842http://www.ibm.com/support/docview.wss?uid=isg1IZ52843http://www.ibm.com/support/docview.wss?uid=isg1IZ52844http://www.ibm.com/support/docview.wss?uid=isg1IZ52845http://www.ibm.com/support/docview.wss?uid=isg1IZ52846http://www.ibm.com/support/docview.wss?uid=isg1IZ52847http://www.ibm.com/support/docview.wss?uid=isg1IZ52848http://www.ibm.com/support/docview.wss?uid=isg1IZ52849http://www.ibm.com/support/docview.wss?uid=isg1IZ52850http://www.ibm.com/support/docview.wss?uid=isg1IZ52851http://www.securityfocus.com/bid/35419http://www.vupen.com/english/advisories/2009/1620http://aix.software.ibm.com/aix/efixes/security/libtt_advisory.aschttp://risesecurity.org/advisories/RISE-2009001.txthttp://secunia.com/advisories/35505http://www.ibm.com/support/docview.wss?uid=isg1IZ52842http://www.ibm.com/support/docview.wss?uid=isg1IZ52843http://www.ibm.com/support/docview.wss?uid=isg1IZ52844http://www.ibm.com/support/docview.wss?uid=isg1IZ52845http://www.ibm.com/support/docview.wss?uid=isg1IZ52846http://www.ibm.com/support/docview.wss?uid=isg1IZ52847http://www.ibm.com/support/docview.wss?uid=isg1IZ52848http://www.ibm.com/support/docview.wss?uid=isg1IZ52849http://www.ibm.com/support/docview.wss?uid=isg1IZ52850http://www.ibm.com/support/docview.wss?uid=isg1IZ52851http://www.securityfocus.com/bid/35419http://www.vupen.com/english/advisories/2009/1620
2009-08-10
Published