CVE-2009-3699

Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

62.09% chance of exploitation in the next 30 days, 99th percentile

Published

2009-10-15

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/aix/rpc_cmsd_opcode21.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/16929

References

• CVE Record
• NVD entry

Related

• CVE-2009-3694
• CVE-2009-3701
• CVE-2009-3693
• CVE-2009-3702
• CVE-2009-3692
• CVE-2009-3703