cbcvebase.
CVE-2009-2754
published 2010-03-05

CVE-2009-2754: Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used…

PriorityP270critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
40.32%
98.5th percentile
Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.

Affected

28 ranges· showing 25
VendorProductVersion rangeFixed in
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——
ibminformix_dynamic_server——

Detection & IOCsextracted from sources · hover to see the quote

port36890↗
filenamelibrpc.dll↗
filenameportmap.exe↗
command__lgto_svcauth_unix↗
bytes↗
\x80\x00\x00\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x86\xb1\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x4c\x00\x00\xd6\x45\xff\xff\xff\xff
  • →The vulnerability is triggered by sending a crafted RPC authentication packet to TCP port 36890 (ISM Portmapper). Monitor for TCP connections to this port from unexpected sources. ↗
  • →The exploit payload contains the distinctive byte sequence \xff\xff\xff\xff at offset 40 (the malicious oversized length field triggering the signedness error). Detect RPC packets to port 36890 containing this pattern. ↗
  • →The exploit packet begins with \x80\x00\x00\x74 (RPC record marking header indicating a 116-byte TCP RPC fragment). Filter for RPC traffic to port 36890 with this leading byte sequence. ↗
  • →The vulnerable function __lgto_svcauth_unix() in librpc.dll performs a signed comparison (jle) of a user-supplied hostname length against 0xFF, allowing 0xFFFFFFFF (-1) to bypass the check and trigger a stack-based buffer overflow via rep movsd. ↗
  • →Monitor for abnormal process behaviour or crashes in portmap.exe (ISM Portmapper service) as exploitation causes a stack-based buffer overflow in this process. ↗
  • ·Affected versions are IBM Informix Dynamic Server 10.x before 10.00.TC9 and 11.x before 11.10.TC3; the same vulnerable librpc.dll is also used in EMC Legato NetWorker. Detection rules should account for both product deployments. ↗
  • ·The PoC is a proof-of-concept crash trigger (no shellcode); real-world exploits may use different payload bytes after the \xff\xff\xff\xff length field while retaining the same RPC framing and signedness-error trigger. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.