CVE-2009-3699
published 2009-10-15CVE-2009-3699: Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows…
PriorityP268critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
62.09%
99.1th percentile
Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect oversized XDR string in the first argument of RPC call to program 100068 (cmsd), version 4, opcode 21 over UDP — a long alphanumeric buffer followed by a 4-byte big-endian return address is the exploit payload pattern. ↗
- →Alert on RPC calls to program 100068 version 4 opcode 21 (rtable_create) where the XDR-encoded first argument string length exceeds normal bounds (exploit uses payload_space ~4104 bytes of random alphanumeric data). ↗
- →Heap spray precursor: watch for 10 rapid successive RPC calls to opcode 7 of program 100068 version 4 immediately before an opcode 21 call — this is the exploit's cache-warming/heap-spray pattern. ↗
- →The exploit uses AUTH_UNIX credentials with uid=0, gid=0 ('localhost', 0, 0, []) in the RPC call to opcode 21 — detect RPC requests to cmsd with null uid/gid AUTH_UNIX from unexpected sources. ↗
- →Monitor inetd/portmapper for crash or unresponsive state on AIX hosts after repeated RPC cmsd opcode 21 calls — the exploit notes unsuccessful attempts may cause inetd/portmapper to enter a broken state. ↗
- ·The exploit payload must avoid null bytes (0x00) and the 0x40 ('@') byte, as the RPC function splits the string on 0x40; detection signatures based on payload content should account for this encoding constraint. ↗
- ·The exploit targets AIX PowerPC (ppc) architecture only; return addresses and NOP sleds are architecture-specific and detection rules relying on shellcode byte patterns must account for big-endian PowerPC encoding. ↗
- ·The actual shellcode/payload is placed outside the overflowing string buffer (heap spray via opcode 7) rather than inline in the opcode 21 argument; detection must cover both the spray (opcode 7) and the trigger (opcode 21) calls. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 - Buffer Overflow (Metasploit)
exploitdb·2010-11-11
CVE-2009-3699 AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 - Buffer Overflow (Metasploit)
AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 - Buffer Overflow (Metasploit)
---
##
# $Id: rpc_cmsd_opcode21.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow vulnerability in opcode 21 handled by
rpc.cmsd on AIX. By making a request with a long string passed to the first
argument of the "rtable_create" RPC, a stack based buffer overflow occurs. This
leads to
Metasploit
AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow
metasploit
AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow
AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow
This module exploits a buffer overflow vulnerability in opcode 21 handled by rpc.cmsd on AIX. By making a request with a long string passed to the first argument of the "rtable_create" RPC, a stack based buffer overflow occurs. This leads to arbitrary code execution. NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where further attempts are not possible.
No writeups or analysis indexed.
http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.aschttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825http://secunia.com/advisories/36978http://securitytracker.com/id?1022996http://www.ibm.com/support/docview.wss?uid=isg1IZ61628http://www.ibm.com/support/docview.wss?uid=isg1IZ61717http://www.ibm.com/support/docview.wss?uid=isg1IZ62123http://www.ibm.com/support/docview.wss?uid=isg1IZ62237http://www.ibm.com/support/docview.wss?uid=isg1IZ62569http://www.ibm.com/support/docview.wss?uid=isg1IZ62570http://www.ibm.com/support/docview.wss?uid=isg1IZ62571http://www.ibm.com/support/docview.wss?uid=isg1IZ62572http://www.ibm.com/support/docview.wss?uid=isg1IZ62672http://www.osvdb.org/58726http://www.securityfocus.com/bid/36615http://www.vupen.com/english/advisories/2009/2846https://exchange.xforce.ibmcloud.com/vulnerabilities/53681https://www.immunityinc.com/downloads/immpartners/aixcmsd10092009.tar.gzhttp://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.aschttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825http://secunia.com/advisories/36978http://securitytracker.com/id?1022996http://www.ibm.com/support/docview.wss?uid=isg1IZ61628http://www.ibm.com/support/docview.wss?uid=isg1IZ61717http://www.ibm.com/support/docview.wss?uid=isg1IZ62123http://www.ibm.com/support/docview.wss?uid=isg1IZ62237http://www.ibm.com/support/docview.wss?uid=isg1IZ62569http://www.ibm.com/support/docview.wss?uid=isg1IZ62570http://www.ibm.com/support/docview.wss?uid=isg1IZ62571http://www.ibm.com/support/docview.wss?uid=isg1IZ62572http://www.ibm.com/support/docview.wss?uid=isg1IZ62672http://www.osvdb.org/58726http://www.securityfocus.com/bid/36615http://www.vupen.com/english/advisories/2009/2846https://exchange.xforce.ibmcloud.com/vulnerabilities/53681https://www.immunityinc.com/downloads/immpartners/aixcmsd10092009.tar.gz
2009-10-15
Published