CVE-2009-4660: BigAnt IM Server AntServer.exe stack buffer overflow via long GET request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with complete impact, public exploit code, and a very high EPSS score make this an urgent fix despite the absence of KEV listing.

What it is

BigAnt IM Server 2.50 contains a stack-based buffer overflow in the AntServer Module (AntServer.exe) reachable over TCP port 6660. A long GET request overflows the buffer and can lead to remote code execution. The flaw is remotely reachable without authentication, making it a serious exposure for any internet-facing or untrusted-network deployment of this server.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the AntServer process, giving full control of the host. The CVSS 2.0 vector (AV:N/AC:L/Au:N/C:C/I:C/A:C) rates confidentiality, integrity and availability impact as complete.

Attack surface

Reached over the network via a crafted long GET request to TCP port 6660, the AntServer service port. No authentication or user interaction is required per the CVSS vector (Au:N) and the description.

Exploitation

Public exploit code exists (Exploit-DB entries 9673 and 9690, and a SecurityFocus BID tagged Exploit), and EPSS is 0.6212 (99th percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Patch or upgrade BigAnt IM Server beyond 2.50 if a fixed release is available; check the vendor advisory for the corrected version.
• If no patch exists, block or restrict TCP port 6660 at the perimeter and between network segments so the AntServer service is not reachable from untrusted networks.
• Isolate the IM server on a dedicated, segmented VLAN with no direct internet exposure and limit inbound access to known client addresses.
• If the product is no longer supported, migrate to a maintained IM server or decommission the AntServer component.
• Monitor and rate-limit inbound connections to port 6660 as a compensating control until the service is patched or removed.

Detection

• Inspect network traffic to TCP port 6660 for unusually long or malformed GET requests that could indicate overflow attempts.
• Alert on AntServer.exe process crashes or restarts, which may follow a failed or successful exploit attempt.
• Hunt for unexpected child processes or command execution spawned by AntServer.exe on the IM server host.
• Review IDS/IPS signatures for CVE-2009-4660 and correlate hits with source IPs connecting to port 6660.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.