IBM Tivoli Storage Manager Express CAD Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service. By sending a "ping" packet containing a long string, an attacker can execute arbitrary code. NOTE: the dsmcad.exe service must be in a particular state (CadWaitingStatus = 1) in order for the vulnerable code to be reached. This state doesn't appear to be reachable when the TSM server is not running. This service does not restart.

Search Other Modules

Exploit Rank

• Good

Exploit Authors

• jduck < jduck [at] metasploit.com >

Vulnerability References

• CVE-2009-3853
• OSVDB-59632

Exploit Targets

• 0 - IBM Tivoli Storage Manager Express 5.3.6.2 (default)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/misc/agentxpp_receive_agentx
• exploit/windows/misc/apple_quicktime_rtsp_response
• exploit/windows/misc/asus_dpcproxy_overflow
• exploit/windows/misc/avidphoneticindexer
• exploit/windows/misc/bakbone_netvault_heap
• exploit/windows/misc/bcaaa_bof
• exploit/windows/misc/bigant_server
• exploit/windows/misc/bigant_server_250
• exploit/windows/misc/bigant_server_usv
• exploit/windows/misc/bomberclone_overflow

Exploit Usage Information

Exploit Module Options