cbcvebase.
CVE-2009-2753
published 2010-03-05

CVE-2009-2753: Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used…

PriorityP263critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
10.92%
95.4th percentile
Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3, allow remote attackers to execute arbitrary code via a crafted parameter size.

Affected

28 ranges· showing 25
VendorProductVersion rangeFixed in
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——

Detection & IOCsextracted from sources · hover to see the quote

port36890↗
filenamelibrpc.dll↗
processportmap.exe↗
bytes↗
\x80\x00\x00\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x86\xb1\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x4c\x00\x00\xd6\x45\xff\xff\xff\xff\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x00\x00\x00\x00\x00\x00\x00\x00
  • →The exploit triggers a signedness error in __lgto_svcauth_unix() by supplying 0xFFFFFFFF (-1) as the hostname length field, which passes a signed comparison (cmp eax, 0FFh / jle) and causes a stack-based buffer overflow via rep movsd with attacker-controlled size. Monitor TCP connections to port 36890 on Informix hosts carrying a 4-byte field of \xff\xff\xff\xff at offset 40 of the RPC payload. ↗
  • →The overflow occurs inside rep movsd using a user-supplied size, causing a stack overflow. Detect anomalously large RPC authentication credential lengths (hostname length field = 0xFFFFFFFF) in TCP streams to the ISM portmapper service on port 36890. ↗
  • →The attack is delivered over TCP to port 36890. Network-level controls should block external access to this port on Informix Dynamic Server hosts. ↗
  • ·The PoC payload is a crash/DoS proof-of-concept (no shellcode); the byte signature above represents the exploit trigger pattern but not a weaponized payload with shellcode. ↗
  • ·The exploit script references CVE-2009-2754 in its header comment, but the NVD entry and the vulnerability description correspond to CVE-2009-2753; verify the correct CVE mapping before applying detections. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.