Advisory Details

February 8th, 2011

Multiple Vendor Calendar Manager RPC Service Remote Code Execution Vulnerability

CVE ID	CVE-2010-4435
CVSS SCORE	10.0, AV:N/AC:L/Au:N/C:C/I:C/A:C
AFFECTED VENDORS	Hewlett-Packard IBM Sun Microsystems
AFFECTED PRODUCTS	HP-UX AIX Solaris 10
TREND MICRO CUSTOMER PROTECTION	Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['9267']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS	This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Calendar Manager RPC Service. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CMSD server (rpc.cmsd) which listens by default on UDP port 32768. The process does not properly handle large XDR-encoded ASCII strings to RPC call 10 followed by RPC call 6. This can be abused by an attacker to overflow a buffer on the remote host. Successful exploitation can result in arbitrary code execution.
ADDITIONAL DETAILS	HP: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02702395 IBM: http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc IBM is not providing credits, as our system at that time and for this brand does not accept credits. Oracle: http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
DISCLOSURE TIMELINE	2009-08-20 - Vulnerability reported to vendor 2011-02-08 - Coordinated public release of advisory
CREDIT	Rodrigo Rubira Branco (BSDaemon)

BACK TO ADVISORIES