cbcvebase.
CVE-2010-3894
published 2010-11-12

CVE-2010-3894: Stack-based buffer overflow in the Java_com_ibm_es_oss_CryptionNative_ESEncrypt function in /opt/IBM/es/lib/libffq.cryptionjni.so in the login form in the…

PriorityP263critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
12.02%
95.7th percentile
Stack-based buffer overflow in the Java_com_ibm_es_oss_CryptionNative_ESEncrypt function in /opt/IBM/es/lib/libffq.cryptionjni.so in the login form in the administration interface in IBM OmniFind Enterprise Edition before 8.5 FP6 allows remote attackers to execute arbitrary code via a long password.

Affected

4 ranges
VendorProductVersion rangeFixed in
ibmomnifind<= 8.5—
ibmomnifind——
ibmomnifind——
ibmomnifind——

Detection & IOCsextracted from sources · hover to see the quote

path/opt/IBM/es/lib/libffq.cryptionjni.so↗
  • →Monitor HTTP POST requests to the IBM OmniFind administration login form where the password field length exceeds 2048 bytes — the fixed-size stack buffer — as this is the trigger condition for the overflow. ↗
  • →Alert on login attempts to the OmniFind administration interface using the default username 'esadmin' combined with an abnormally long password string, which is the expected exploitation pattern. ↗
  • →The second attack vector is constrained to printable ASCII characters in the overwrite payload; IDS/WAF rules should flag password fields containing >2080 bytes of printable ASCII as a high-confidence exploit attempt. ↗
  • →During exploitation, register ESI points to attacker-controlled input; look for 'call *%esi' gadget usage patterns consistent with ASCII-filtered shellcode execution in process memory of the IBM OmniFind service. ↗
  • →The IBM OmniFind administration service runs as root by default; any successful exploitation results in a root shell — prioritize process-level monitoring of the OmniFind admin process for unexpected child process spawning. ↗
  • ·The vulnerable fixed-size stack buffer is exactly 2048 bytes; the overflow is triggered at 2080+ bytes in the password field, meaning the first 2048 bytes are benign and only the overflow portion is malicious — simple length-based blocking at 2048 bytes would prevent exploitation. ↗
  • ·The two-stage attack requires a valid writable address as the 'firstattackpoint' to reach the saved return address overwrite; without a valid writable address at offset 2080, the second-stage EIP overwrite is not reachable. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.