HP-UX 'rpc.cmsd' Calendar Manager Daemon Remote Buffer Overflow Vulnerability

Bugtraq ID:	46261
Class:	Boundary Condition Error
CVE:	CVE-2010-4435
Remote:	Yes
Local:	No
Published:	Feb 08 2011 12:00AM
Updated:	Jan 25 2014 09:44AM
Credit:	Rodrigo Rubira Branco (BSDaemon) and the Zero Day Initiative
Vulnerable:	HP HP-UX B.11.31 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.23
Not Vulnerable:

HP-UX 'rpc.cmsd' Calendar Manager Daemon Remote Buffer Overflow Vulnerability

HP-UX is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. This issue affects the CDE Calendar Manager Remote Procedure Call (RPC) service ('rpc.cmsd').

Remote attackers can exploit this issue to execute arbitrary code with superuser privileges, which can result in the complete compromise of affected computers. Failed exploit attempts will cause a denial-of-service condition.

HP-UX 'rpc.cmsd' Calendar Manager Daemon Remote Buffer Overflow Vulnerability

Exploit code is available for a related issue for IBM AIX; see BID 36615 (IBM AIX 'rpc.cmsd' Calendar Daemon Remote Stack Buffer Overflow Vulnerability) for more information.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/cmsd_cve2010-4435.c

HP-UX 'rpc.cmsd' Calendar Manager Daemon Remote Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

HP-UX 'rpc.cmsd' Calendar Manager Daemon Remote Buffer Overflow Vulnerability

References:

• HP-UX Homepage (HP)
  
• ZDI-11-062: Multiple Vendor Calendar Manager RPC Service Remote Code Execution (ZDI Disclosures )
  
• HPSBUX02628 SSRT090183 rev.1 - HP-UX Running CDE Calendar Manager, Remote Execut (HP)
  
• ZDI-11-062 Multiple Vendor Calendar Manager RPC Service Remote Code Execution Vu (Zero Day Initiative)