Unscored severity · published Oct 15, 2009
CVE-2009-3699
Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to…
–
CVSS
62.3%
EPSS
No
On KEV
Description
Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.
Exploitation
Is it being used?
Exploit prediction (EPSS)62.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Aix · Ibm
5; 5.1; 5.1.0.10; 5.1l; 5.2; 5.2.0; +20 more · source: NVD
VI
Vios · Ibm
through 2.1.0; 1.4; 1.5.0; 1.5.1; 1.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3699
Vendor Advisory
http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc
Patch
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825
Vendor Advisory
http://secunia.com/advisories/36978
securitytracker.com
http://securitytracker.com/id?1022996
www.ibm.com
http://www.ibm.com/support/docview.wss?uid=isg1IZ61628
www.ibm.com
http://www.ibm.com/support/docview.wss?uid=isg1IZ61717
More from Aix
10.0
CVE-2024-56346
IBM AIX command execution
9.9
CVE-2026-18835
Vulnerabilities in IBM AIX and PowerVM VIOS
9.9
CVE-2026-16816
Vulnerabilities in IBM AIX and PowerVM VIOS
9.9
CVE-2026-15068
Vulnerabilities in IBM AIX and PowerVM VIOS
9.8
CVE-2026-19437
Vulnerabilities in IBM AIX and PowerVM VIOS