CVE-2009-3699
IBM VIOS < 2.1.0 and AIX 5.x-6.1.3 - Remote Code Execution via Long XDR String in rpc.cmsd
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-3699.
PoCs published by Metasploit, Rodrigo Rubira Branco (BSDaemon), jduck, including Metasploit module exploits/aix/rpc_cmsd_opcode21.
AI-analyzed exploit summary This Metasploit module exploits a stack-based buffer overflow in the AIX Calendar Manager Service Daemon (rpc.cmsd) via opcode 21. It achieves arbitrary code execution by sending a maliciously crafted RPC request with an overly long string to the 'rtable_create' function.
Description
Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.
Exploits (2)
This Metasploit module exploits a stack-based buffer overflow in the AIX Calendar Manager Service Daemon (rpc.cmsd) via opcode 21. It achieves arbitrary code execution by sending a maliciously crafted RPC request with an overly long string to the 'rtable_create' function.
This Metasploit module exploits a stack-based buffer overflow in the AIX Calendar Manager Service Daemon (rpc.cmsd) via opcode 21, leading to arbitrary code execution. It uses a brute-force approach to bypass memory randomization and includes heap spraying to address PowerPC cache issues.