Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-2753 — Improper Restriction of Operations within the Bounds of a Memory Buffer in IBM Informix Dynamic Server

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
10.0CRITICALNVD
EPSS
30.5%
top 3.29%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
IBM Informix Dynamic Server
Timeline
PublishedMar 5
Latest updateMay 2

Description

Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3, allow remote attackers to execute arbitrary code via a crafted parameter size.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

▶NVDibm/informix_dynamic_server28 versions+27

Patches

Patch: www.vupen.com ↗Patch: www.vupen.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-3pm5-9xjq-m3q6: Multiple buffer overflows in the authentication functionality in librpc↗2022-05-02
▶
CVEList
CVE-2009-2753: Multiple buffer overflows in the authentication functionality in librpc↗2010-03-05
▶

💥Exploits & PoCs

1
Exploit-DB
Multiple Vendor 'librpc.dll' Signedness Error - Remote Code Execution↗2010-04-08
▶
CVE-2009-2753 — IBM vulnerability | cvebase