CVE-2009-2727

IBM AIX 5.2.0, 5.3.0, 5.3.7-5.3.10, 6.1.0-6.1.3 - Stack-Based Buffer Overflow in _tt_internal_realpath

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2009-2727. PoCs published by Metasploit, Ramon de C Valle, including Metasploit module exploits/aix/rpc_ttdbserverd_realpath.

AI-analyzed exploit summary This is a Metasploit module exploiting a buffer overflow in the ToolTalk database server (rpc.ttdbserverd) on IBM AIX systems. It targets multiple AIX versions and uses a brute-force approach to bypass memory address randomization.

Description

Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3, when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf, allows remote attackers to execute arbitrary code via a long XDR-encoded ASCII string to remote procedure 15.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremoteaix
https://www.exploit-db.com/exploits/16930

This is a Metasploit module exploiting a buffer overflow in the ToolTalk database server (rpc.ttdbserverd) on IBM AIX systems. It targets multiple AIX versions and uses a brute-force approach to bypass memory address randomization.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: IBM AIX ToolTalk rpc.ttdbserverd (versions 5.3.7 to 6.1.4)
No auth needed
Prerequisites: Network access to the target system · rpc.ttdbserverd service running on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
by Ramon de C Valle · rubypocaix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/aix/rpc_ttdbserverd_realpath.rb

This Metasploit module exploits a buffer overflow in the _tt_internal_realpath function of the ToolTalk database server (rpc.ttdbserverd) on IBM AIX systems. It includes multiple targets for different AIX versions and uses a brute-force approach to bypass memory randomization.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: IBM AIX ToolTalk rpc.ttdbserverd (versions 5.3.7 to 6.1.4)
No auth needed
Prerequisites: Network access to the target system · ToolTalk database server (rpc.ttdbserverd) running on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (15)

Core 15
Core References
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52843
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35505
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1620
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52848
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52844
Various Sources x_refsource_misc
http://risesecurity.org/advisories/RISE-2009001.txt
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52850
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52847
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52849
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/35419
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52851
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52842
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52846
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1IZ52845

Scores

EPSS 0.2675
EPSS Percentile 97.8%

Details

CWE
CWE-119
Status published
Products (16)
ibm/aix 5.2
ibm/aix 5.2.0
ibm/aix 5.2.0.50
ibm/aix 5.2.0.54
ibm/aix 5.2.2
ibm/aix 5.2_l
ibm/aix 5.3
ibm/aix 5.3.0
ibm/aix 5.3.7
ibm/aix 5.3.8
... and 6 more
Published Aug 10, 2009
Tracked Since Feb 18, 2026