CVE-2009-3691

IBM Informix Client SDK 3.0 - '.nfx' File Integer Overflow

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-3691 has a selected CVSS score of 9.3; EIP currently links 1 catalogued exploit.

Description

Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize, and possibly (2) ProtoSize and (3) ServerSize, field that triggers a stack-based buffer overflow involving a crafted HostList field. NOTE: some of these details are obtained from third party information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBIBM Informix Client SDK 3.0 - '.nfx' File Integer OverflowExploitDB exploitby bruiserExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PHP script generates a malicious .nfx file that exploits an integer overflow in IBM Informix setnet32.exe to achieve arbitrary code execution via a stack-based buffer overflow.

Backdoor review

No backdoor observed in reviewed code

The PoC is a PHP script that generates a malicious .nfx file to exploit CVE-2009-3691, a stack-based buffer overflow in IBM Informix setnet32.exe. The script constructs a payload containing shellcode that adds a user (sun/tzu) to the target Windows system. All behavior is consistent with the stated exploit objective; no concealed backdoor, unrelated payload, or operator-directed deception was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesphp
Target softwareIBM Informix Client SDK 3.0IBM Informix Connect Runtime 3.xsetnet32.exe
Attack typesinteger overflowstack-based buffer overflowarbitrary code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script generates a file containing a shellcode payload and crafted fields designed to trigger a vulnerability and execute arbitrary code, which is the definition of an exploit.

exploits/windows/remote/10070.php:2exploits/windows/remote/10070.php:24-60exploits/windows/remote/10070.php:130-150

Requirements

  • Victim must open the generated .nfx file with a vulnerable version of setnet32.exe.exploits/windows/remote/10070.php:20

Observed behavior

  • Constructs a .nfx file with a crafted HostSize value of 1517 to trigger an integer overflow.exploits/windows/remote/10070.php:130
  • Embeds a shellcode payload that adds a user 'sun' with password 'tzu' to the Windows system.exploits/windows/remote/10070.php:24-27
  • Writes the crafted exploit content to a file named '9sg.nfx'.exploits/windows/remote/10070.php:175
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Shellcode
Payload withheldThe embedded shellcode is the exploit payload, directly related to the stated vulnerability exploitation.exploits/windows/remote/10070.php:24-60
Exploit Mechanism
Payload withheldThe script sets HostSize=1517 and constructs a HostList with NOP sled, shellcode, and ROP chain to hijack execution.exploits/windows/remote/10070.php:130-150
File Creation
Payload withheldThe script outputs the crafted exploit file locally; no network exfiltration or unexpected file operations.exploits/windows/remote/10070.php:175
Review boundaries

What the analysis did not establish

  • Only the single PHP file was reviewed; no external dependencies or runtime behavior were analyzed.
  • Binary content within the shellcode was not disassembled or executed; its behavior is inferred from the Metasploit comment.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

8