CVE-2009-1291

Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product Family (aka RTworks) before 4.0.5, and Enterprise Message Service (EMS) 4.0.0 through 5.1.1, as used in SmartSockets Server and RTworks Server (aka RTserver), SmartSockets client libraries and add-on products, RTworks libraries and components, EMS Server (aka tibemsd), SmartMQ, iProcess Engine, ActiveMatrix products, and CA Enterprise Communicator, allows remote attackers to execute arbitrary code via "inbound data," as demonstrated by requests to the UDP interface of the RTserver component, and data injection into the TCP stream to tibemsd.

• CWE-119

• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=785
• http://secunia.com/advisories/34911Vendor Advisory
• http://securitytracker.com/id?1022129
• http://www.harmonysecurity.com/blog/2009/04/tibco-smartsockets-stack-buffer.html
• http://www.securityfocus.com/bid/34754
• http://www.tibco.com/multimedia/security_advisory_ems_tcm8-7558.txtVendor Advisory
• http://www.tibco.com/multimedia/security_advisory_rtworks_tcm8-7559.txtVendor Advisory
• http://www.tibco.com/multimedia/security_advisory_smartsockets_tcm8-7560.txtVendor Advisory
• http://www.tibco.com/services/support/advisories/default.jspPatch, Vendor Advisory
• http://www.tibco.com/services/support/advisories/smartsockets-sspfm-ems_advisory_20090428.jspVendor Advisory
• http://www.vupen.com/english/advisories/2009/1198Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50214
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=785
• http://secunia.com/advisories/34911Vendor Advisory
• http://securitytracker.com/id?1022129
• http://www.harmonysecurity.com/blog/2009/04/tibco-smartsockets-stack-buffer.html
• http://www.securityfocus.com/bid/34754
• http://www.tibco.com/multimedia/security_advisory_ems_tcm8-7558.txtVendor Advisory
• http://www.tibco.com/multimedia/security_advisory_rtworks_tcm8-7559.txtVendor Advisory
• http://www.tibco.com/multimedia/security_advisory_smartsockets_tcm8-7560.txtVendor Advisory
• http://www.tibco.com/services/support/advisories/default.jspPatch, Vendor Advisory
• http://www.tibco.com/services/support/advisories/smartsockets-sspfm-ems_advisory_20090428.jspVendor Advisory
• http://www.vupen.com/english/advisories/2009/1198Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50214

Published

Apr 30, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1285Static code injection vulnerability in the getConfigFile fun…
• CVE-2009-1286The IMAP task in the server in IBM Lotus Domino 8.0.2 before…
• CVE-2009-1287Cross-site scripting (XSS) vulnerability in Cisco Subscriber…
• CVE-2009-1288Multiple cross-site scripting (XSS) vulnerabilities in the A…
• CVE-2009-1289private/login.ssi in the Advanced Management Module (AMM) on…
• CVE-2009-1290Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2009-1292UCM-CQ in IBM Rational ClearCase 7.0.0.x before 7.0.0.5, 7.0…
• CVE-2009-1293The web login functionality (c/portal/login) in Novell Teami…
• CVE-2009-1294Multiple cross-site scripting (XSS) vulnerabilities in web/g…
• CVE-2009-1295Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on …
• CVE-2009-1296The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.…
• CVE-2009-1297iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through …