CVE Feed

    Dashboard / CVE / CVE-2009-2754

    CVE-2009-2754

    Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.

    Published:Mar 5, 2010
    Last Modified:Apr 11, 2025
    EPS:Mar 5, 2010
    EPSS Score:0.30961
    CVSS Score:10

    Affected Products

    Vendor
    Emc
    Product
    Legato Networker
    Vendor
    Ibm
    Product
    Informix Dynamic Server

    Exploits

    https://www.exploit-db.com/exploits/12109

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2007-3618 (CVSS 9.3) — Stack-based buffer overflow in the NetWorker Remote Exec Service (nsrexecd.exe) in EMC Software NetWorker 7.x.…
    CVE-2005-3659 (CVSS 5) — nsrd.exe in EMC Legato NetWorker 7.1.x before 7.1.4 and 7.2.x before 7.2.1.Build.314, and other products such …
    CVE-2005-3658 (CVSS 7.5) — Multiple heap-based buffer overflows in EMC Legato NetWorker 7.1.x before 7.1.4 and 7.2.x before 7.2.1.Build.3…
    CVE-2005-0357 (CVSS 7.5) — EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 rely on …
    CVE-2005-0358 (CVSS 7.5) — EMC Legato NetWorker, Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 6.0 through 7.2 do not prope…
    CVE-2005-0359 (CVSS 6.4) — The Legato PortMapper in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup…

    References

    http://knowledgebase.emc.com/emcice/login.do?sType=ax1990&sName=1204&id=emc183834
    http://secunia.com/advisories/38731
    http://www.ibm.com/support/docview.wss?uid=swg1IC55329
    http://www.ibm.com/support/docview.wss?uid=swg1IC55330
    http://www.securityfocus.com/archive/1/509793/100/0/threaded
    http://www.securityfocus.com/bid/38472
    http://www.vupen.com/english/advisories/2010/0508
    http://www.vupen.com/english/advisories/2010/0509
    http://www.zerodayinitiative.com/advisories/ZDI-10-023
    https://exchange.xforce.ibmcloud.com/vulnerabilities/56586
    http://knowledgebase.emc.com/emcice/login.do?sType=ax1990&sName=1204&id=emc183834
    http://secunia.com/advisories/38731
    http://www.ibm.com/support/docview.wss?uid=swg1IC55329
    http://www.ibm.com/support/docview.wss?uid=swg1IC55330
    http://www.securityfocus.com/archive/1/509793/100/0/threaded
    http://www.securityfocus.com/bid/38472
    http://www.vupen.com/english/advisories/2010/0508
    http://www.vupen.com/english/advisories/2010/0509
    http://www.zerodayinitiative.com/advisories/ZDI-10-023
    https://exchange.xforce.ibmcloud.com/vulnerabilities/56586

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High