CVEvulnerability
CVE-2009-1291
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-04-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-119
Description
Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product Family (aka RTworks) before 4.0.5, and Enterprise Message Service (EMS) 4.0.0 through 5.1.1, as used in SmartSockets Server and RTworks Server (aka RTserver), SmartSockets client libraries and add-on products, RTworks libraries and components, EMS Server (aka tibemsd), SmartMQ, iProcess Engine, ActiveMatrix products, and CA Enterprise Communicator, allows remote attackers to execute arbitrary code via "inbound data," as demonstrated by requests to the UDP interface of the RTserver component, and data injection into the TCP stream to tibemsd.
Affected configurations
• tibco enterprise message service (<= 5.1.1)
• tibco enterprise message service 4.0.0
• tibco enterprise message service 4.1.0
• tibco enterprise message service 4.2.0
• tibco enterprise message service 4.3.0
• tibco enterprise message service 4.4.1
• tibco enterprise message service 4.4.2
• tibco rtworks 4.0.3
• tibco rtworks 4.0.4
• tibco smartsockets 6.8.0
• tibco smartsockets 6.8.1
• tibco smartsockets rtserver (<= 6.8.1)
• tibco smartsockets rtserver 6.8.0
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=785 labs.idefense.com
- http://secunia.com/advisories/34911 Vendor Advisory
- http://securitytracker.com/id?1022129 securitytracker.com
- http://www.harmonysecurity.com/blog/2009/04/tibco-smartsockets-stack-buffer.html www.harmonysecurity.com
- http://www.securityfocus.com/bid/34754 www.securityfocus.com
- http://www.tibco.com/multimedia/security_advisory_ems_tcm8-7558.txt Vendor Advisory
- http://www.tibco.com/multimedia/security_advisory_rtworks_tcm8-7559.txt Vendor Advisory
- http://www.tibco.com/multimedia/security_advisory_smartsockets_tcm8-7560.txt Vendor Advisory
- http://www.tibco.com/services/support/advisories/default.jsp Patch, Vendor Advisory
- http://www.tibco.com/services/support/advisories/smartsockets-sspfm-ems_advisory_20090428.jsp Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1198 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50214 exchange.xforce.ibmcloud.com
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=785 labs.idefense.com
- http://secunia.com/advisories/34911 Vendor Advisory
- http://securitytracker.com/id?1022129 securitytracker.com
- http://www.harmonysecurity.com/blog/2009/04/tibco-smartsockets-stack-buffer.html www.harmonysecurity.com
- http://www.securityfocus.com/bid/34754 www.securityfocus.com
- http://www.tibco.com/multimedia/security_advisory_ems_tcm8-7558.txt Vendor Advisory
- http://www.tibco.com/multimedia/security_advisory_rtworks_tcm8-7559.txt Vendor Advisory
- http://www.tibco.com/multimedia/security_advisory_smartsockets_tcm8-7560.txt Vendor Advisory
- http://www.tibco.com/services/support/advisories/default.jsp Patch, Vendor Advisory
- http://www.tibco.com/services/support/advisories/smartsockets-sspfm-ems_advisory_20090428.jsp Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1198 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50214 exchange.xforce.ibmcloud.com