← Vulnerability feed

Vulnerability record · CVE-2009-2754 · published 5 March 2010

CVE-2009-2754: Ibm informix dynamic server vulnerability

Ibm · Informix Dynamic Server

Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.

10.0 CVSS 2.0 High EPSS 40% · top 1.4% CWE-189 · CWE-189
10.0CVSS 2.0 base score
40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
20References
16 Jun 2026Last modified by NVD

Description

Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://knowledgebase.emc.com/emcice/login.do?sType=ax1990&sName=1204&id=emc183834
http://secunia.com/advisories/38731 Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg1IC55329
http://www.ibm.com/support/docview.wss?uid=swg1IC55330
http://www.securityfocus.com/archive/1/509793/100/0/threaded
http://www.securityfocus.com/bid/38472
http://www.vupen.com/english/advisories/2010/0508 PatchVendor Advisory
http://www.vupen.com/english/advisories/2010/0509 PatchVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-023
https://exchange.xforce.ibmcloud.com/vulnerabilities/56586
http://knowledgebase.emc.com/emcice/login.do?sType=ax1990&sName=1204&id=emc183834
http://secunia.com/advisories/38731 Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg1IC55329
http://www.ibm.com/support/docview.wss?uid=swg1IC55330
http://www.securityfocus.com/archive/1/509793/100/0/threaded
http://www.securityfocus.com/bid/38472
http://www.vupen.com/english/advisories/2010/0508 PatchVendor Advisory
http://www.vupen.com/english/advisories/2010/0509 PatchVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-023
https://exchange.xforce.ibmcloud.com/vulnerabilities/56586

Track CVE-2009-2754 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-4070Ibm informix dynamic server vulnerabilityInteger overflow in librpc.dll in portmap.exe (aka the ISM Portmapper service) in ISM before 2.20.TC1.117 in IBM Informix Dynamic Server (IDS) 7.x be…EPSS 5.1%10.0CVE-2009-2753Ibm informix dynamic server memory buffer overflow vulnerabilityMultiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe…EPSS 11%10.0CVE-2008-0949Ibm informix dynamic server vulnerabilityUnspecified vulnerability in IBM Informix Dynamic Server (IDS) 7.x through 11.x allows remote attackers to gain privileges via a malformed connection…EPSS 2.6%10.0CVE-2008-0768Ibm informix dynamic server memory buffer overflow vulnerabilityMultiple stack-based and heap-based buffer overflows in the Windows RPC components for IBM Informix Storage Manager (ISM), as used in Informix Dynami…EPSS 4.5%9.3CVE-2011-1033Ibm informix dynamic server memory buffer overflow vulnerabilityStack-based buffer overflow in oninit in IBM Informix Dynamic Server (IDS) 11.50 allows remote attackers to execute arbitrary code via crafted argume…EPSS 4.8%9.3CVE-2007-3618Emc legato networker vulnerabilityStack-based buffer overflow in the NetWorker Remote Exec Service (nsrexecd.exe) in EMC Software NetWorker 7.x.x allows remote attackers to execute ar…EPSS 7.1%9.0CVE-2012-4857Ibm informix dynamic server memory buffer overflow vulnerabilityBuffer overflow in IBM Informix 11.50 through 11.50.xC9W2 and 11.70 before 11.70.xC7 allows remote authenticated users to execute arbitrary code via …EPSS 4.6%9.0CVE-2012-3334Ibm informix dynamic server memory buffer overflow vulnerabilityStack-based buffer overflow in IBM Informix Dynamic Server (IDS) 11.50 before 11.50.xC9W2 and 11.70 before 11.70.xC5 allows remote authenticated user…EPSS 3.7%

Source: NIST National Vulnerability Database (record CVE-2009-2754), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.