Description
Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow
exploit/aix/rpc_cmsd_opcode21
Exploit-DB 1
- AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 - Buffer Overflow (Metasploit) EDB-16929 · dos · Nov 11, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2009-2846 vdb-entry
- IZ62237 vendor-advisory
- IZ62570 vendor-advisory
- IZ61628 vendor-advisory
- 1022996 vdb-entry
- 20091007 IBM AIX rpc.cmsd Stack Buffer Overflow Vulnerability third-party-advisory
- http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc
- IZ62569 vendor-advisory
- ibm-aix-rpccmsd-bo(53681) vdb-entry
- IZ62571 vendor-advisory
- IZ62123 vendor-advisory
- IZ62672 vendor-advisory
- IZ62572 vendor-advisory
- 36978 third-party-advisory
- IZ61717 vendor-advisory
- https://www.immunityinc.com/downloads/immpartners/aixcmsd10092009.tar.gz
- 58726 vdb-entry
- 36615 vdb-entry