Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-1291

Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product Family (aka RTworks) before 4.0.5, and Enterprise Message Service (EMS) 4.0.0 through 5.1.1, as used in SmartSockets Server and RTworks Server (aka RTserver), SmartSockets client libraries and add-on products, RTworks libraries and components, EMS Server (aka tibemsd), SmartMQ, iProcess Engine, ActiveMatrix products, and CA Enterprise Communicator, allows remote attackers to execute arbitrary code via "inbound data," as demonstrated by requests to the UDP interface of the RTserver component, and data injection into the TCP stream to tibemsd.

Published

2009-04-30T20:30:00.377

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application tibco enterprise_message_service ≤ 5.1.1 Yes
Application tibco enterprise_message_service 4.0.0 Yes
Application tibco enterprise_message_service 4.1.0 Yes
Application tibco enterprise_message_service 4.2.0 Yes
Application tibco enterprise_message_service 4.3.0 Yes
Application tibco enterprise_message_service 4.4.1 Yes
Application tibco enterprise_message_service 4.4.2 Yes
Application tibco rtworks 4.0.3 Yes
Application tibco rtworks 4.0.4 Yes
Application tibco smartsockets 6.8.0 Yes
Application tibco smartsockets 6.8.1 Yes
Application tibco smartsockets_rtserver ≤ 6.8.1 Yes
Application tibco smartsockets_rtserver 6.8.0 Yes
References