CVE-2009-2754
35Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 40%
from disclosure to weapon34 days
Published on NVDMar 5
1st PoC+34d
exploitation probability
40%top 2% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/12109⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://knowledgebase.emc.com/emcice/login.do?sType=ax1990&sName=1204&id=emc183834http://secunia.com/advisories/38731https://exchange.xforce.ibmcloud.com/vulnerabilities/56586http://www.ibm.com/support/docview.wss?uid=swg1IC55329http://www.ibm.com/support/docview.wss?uid=swg1IC55330http://www.securityfocus.com/archive/1/509793/100/0/threadedhttp://www.securityfocus.com/bid/38472http://www.vupen.com/english/advisories/2010/0508http://www.vupen.com/english/advisories/2010/0509http://www.zerodayinitiative.com/advisories/ZDI-10-023