Multiple Vendor 'librpc.dll' Stack Buffer Overflow Vulnerability

Bugtraq ID:	38472
Class:	Boundary Condition Error
CVE:	CVE-2009-2754
Remote:	Yes
Local:	No
Published:	Mar 01 2010 12:00AM
Updated:	Apr 08 2010 01:42PM
Credit:	Sebastian Apelt
Vulnerable:	IBM Informix IDS 9.40 .UC3 IBM Informix IDS 9.40 .UC2 IBM Informix IDS 9.40 .UC1 IBM Informix IDS 9.3 IBM Informix IDS 9.40.xD8 IBM Informix IDS 9.40.UC5 IBM Informix IDS 9.40.TC5 IBM Informix IDS 9.40 IBM Informix IDS 9.4 IBM Informix IDS 7.31 .xD9 IBM Informix IDS 7.31 .xD8 IBM Informix IDS 7.3 IBM Informix IDS 11.10.xC4 IBM Informix IDS 11.10.xC2 IBM Informix IDS 11.10 IBM Informix IDS 10.00.xC8 IBM Informix IDS 10.00.xC7W1 IBM Informix IDS 10.00.xC11 IBM Informix IDS 10.0.xC4 IBM Informix IDS 10.0 xC3 IBM Informix IDS 10.0 EMC Legato Networker 7.3.2 EMC Legato Networker 7.2.1 EMC Legato Networker 7.2 build 172 EMC Legato Networker 7.2 EMC Legato Networker 7.1.3 EMC Legato Networker 7.0 EMC Legato Networker 6.0 x
Not Vulnerable:	IBM Informix IDS 11.10.TC3 IBM Informix IDS 10.00.TC9

Multiple Vendor 'librpc.dll' Stack Buffer Overflow Vulnerability

The 'librpc.dll' RPC protocol parsing library is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data.

Successfully exploiting this issue will allow attackers to execute arbitrary code with SYSTEM-level privileges. Failed exploit attempts will result in a denial-of-service condition.

The following products are vulnerable:

IBM Informix IDS
EMC Legato Networker

Multiple Vendor 'librpc.dll' Stack Buffer Overflow Vulnerability

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/38472.py

Multiple Vendor 'librpc.dll' Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

Multiple Vendor 'librpc.dll' Stack Buffer Overflow Vulnerability

References:

• EMC Legato Networker Homepage (EMC)
  
• Informix Homepage (IBM)
  
• ZDI-10-023: Multiple Vendor librpc.dll Signedness Error Remote Code Execution Vu (Zero Day Initiative)