CVE-2009-4988: SAP Business One NT_Naming_Service.exe stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityPre-authentication remote code execution with a CVSS 2.0 score of 10 and public exploit code makes this a top-priority exposure wherever port 30000 is reachable.

What it is

NT_Naming_Service.exe in SAP Business One 2005 A (6.80.123 and 6.80.320) contains a stack-based buffer overflow reachable through a long GIOP request sent to TCP port 30000. Because the flaw is remotely triggerable with no authentication and yields full code execution, it is a serious pre-auth risk for any exposed Business One naming service.

Impact

A remote attacker can execute arbitrary code in the context of the NT_Naming_Service.exe process, giving full control of the affected host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

Reached over the network via a crafted GIOP request to TCP port 30000; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required. Any host with the naming service port reachable is a candidate target.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.655, 99th percentile) and references include an Exploit tag plus an Exploit-DB entry, indicating public exploit code exists.

What to do

• Apply the SAP fix or upgrade to a supported Business One release; the record does not list a specific patch ID, so confirm the current SAP advisory.
• Block or restrict TCP port 30000 to trusted hosts only; do not expose the naming service to untrusted networks.
• Segment Business One servers so the naming service is not reachable from general user or internet networks.
• If the service is not required, disable NT_Naming_Service.exe.
• Monitor SAP advisories for this product line and re-check exposure after any upgrade.

Detection

• Alert on long or malformed GIOP requests to TCP port 30000, especially oversized payloads.
• Monitor NT_Naming_Service.exe for crashes or unexpected restarts, which can indicate exploitation attempts.
• Watch for child processes or unusual outbound connections spawned by NT_Naming_Service.exe.
• Review network logs for scanning or repeated connections to port 30000 from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.