CVE-2012-0202

published 2012-05-04

CVE-2012-0202: Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a…

Priority P2 66 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted data.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
ibm	cognos_tm1	—	—
ibm	cognos_tm1	—	—
ibm	cognos_tm1	—	—
ibm	cognos_tm1	—	—

Detection & IOCs extracted from sources · hover to see the quote

process tm1admsd.exe↗

port 5498↗

bytes↗

\x00\x08 (Opcode field in crafted packet)

• → Monitor for inbound TCP connections to port 5498 (IBM Cognos TM1 Admin Server default port) with oversized or malformed payloads; the exploit sends a crafted packet with a 2-byte length prefix followed by a 2-byte opcode of 0x0008 and a large data blob exceeding 10359 bytes. ↗
• → Detect exploit packets targeting port 5498 where the opcode field is 0x0008 and the payload length field (network byte order) indicates a value consistent with a buffer overflow (e.g., ~10359+ bytes). ↗
• → Alert on tm1admsd.exe process crashes or unexpected termination, which may indicate a denial-of-service attempt or exploitation attempt via the stack buffer overflow. ↗
• → The exploit uses SSL/TLS1 for transport; inspect TLS1 traffic to port 5498 for anomalously large handshake or application-layer payloads indicative of overflow attempts. ↗
• → The exploit appends 2000 bytes of random data after the SEH overwrite to trigger the exception; look for TCP payloads to port 5498 with total length exceeding ~12000 bytes as a heuristic. ↗

• · The Metasploit module was tested only against IBM Cognos Express 9.5 on Windows XP SP3; the hardcoded return address (RET gadget) is specific to tm1admsd.exe version 9.5.10009.10070 and unicode.nls on that platform. Exploitation on other versions or OS configurations requires a different RET value. ↗
• · The exploit requires SSL (TLS1) to be enabled on the target Admin Server; detection rules inspecting plaintext traffic to port 5498 will miss this exploit unless TLS inspection is in place. ↗
• · The payload space is constrained to 10359 bytes (minus NOP sled), which limits shellcode options; DisableNops is set to true, meaning standard NOP-sled detection will not fire on this exploit. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119