CVE-2009-2754: Emc Legato Networker

High severity, CVSS 10.0. EPSS: 40.1% chance of exploitation in the next 30 days.

Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.

Affected products

• Emc Legato Networker: any version
• IBM Informix Dynamic Server: version 10.0 only; version 10.0.tc1 only; version 10.0.xc1 only; version 10.0.xc2e only; version 10.0.xc3 only; version 10.0.xc3e only; …

Published 2010-03-05. Last modified 2026-06-16.