Oracle Solaris CVE-2010-3509 'rpc.cmsd' Remote Buffer Overflow Vulnerability

Bugtraq ID:	43933
Class:	Unknown
CVE:	CVE-2010-3509
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Oct 18 2010 09:39PM
Credit:	Alex Kaszczuk, Alan Chin, Jose R. Hernandez, and r@b13$ from the Digital Defense, Inc. Vulnerability Research Team
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc Avaya Interactive Response 4.0 Avaya Interactive Response 3.0 Avaya CMS Server 16.1 Avaya CMS Server 16.0 Avaya CMS Server 15.0
Not Vulnerable:

Oracle Solaris CVE-2010-3509 'rpc.cmsd' Remote Buffer Overflow Vulnerability

Oracle Solaris is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with root privileges. Failed exploit attempts will cause a denial-of-service condition.

This vulnerability affects the following supported versions:
8, 9, 10

Oracle Solaris CVE-2010-3509 'rpc.cmsd' Remote Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Solaris CVE-2010-3509 'rpc.cmsd' Remote Buffer Overflow Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle Solaris CVE-2010-3509 'rpc.cmsd' Remote Buffer Overflow Vulnerability

References:

• DIVRT-2009-28 Sun Solaris 10 rpc.cmsd Buffer Overflow and Denial of Service (CVE (ddivulnalert)
  
• ASA-2010-299 Solaris RPC Scheduler Vulnerability CVE-2010-3509 (Avaya)
  
• Oracle Critical Patch Update Advisory - October 2010 (Oracle)