CVE-2009-20005

A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability is triggered by sending a specially crafted HTTP GET request containing an oversized argument to the .csp handler. Due to insufficient bounds checking, the input overflows a stack buffer, allowing an attacker to overwrite control structures and execute arbitrary code. It is unknown if this vulnerability was patched and an affected version range remains undefined.

CVSS

No CVSS.

References

Link	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/intersystems_cache.rb
https://www.exploit-db.com/exploits/16807
https://www.intersystems.com/products/cache/
https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.APP:INTERSYSTEMS-CACHE-OF.html
https://www.vulncheck.com/advisories/intersystems-cache-stack-buffer-overflow
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/intersystems_cache.rb
https://www.exploit-db.com/exploits/16807

Configurations

No configuration.

History

01 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Un desbordamiento de búfer basado en pila existe en el endpoint UtilConfigHome.csp de InterSystems Caché 2009.1. La vulnerabilidad se activa al enviar una solicitud HTTP GET especialmente diseñada que contiene un argumento de tamaño excesivo al gestor .csp. Debido a una comprobación de límites insuficiente, la entrada desborda un búfer de pila, permitiendo a un atacante sobrescribir estructuras de control y ejecutar código arbitrario. Se desconoce si esta vulnerabilidad fue parcheada y un rango de versiones afectadas permanece indefinido.

Information

Published : 2025-09-16 15:15

Updated : 2026-10-01 23:10

NVD link : CVE-2009-20005

Mitre link : CVE-2009-20005

CVE.ORG link : CVE-2009-20005

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2009-20005", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2009-20005", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-16T18:18:32.419926Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "InterSystems Corporation", "modules": ["/csp/sys/mgr/UtilConfigHome.csp"], "product": "InterSystems Cach\u00e9", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2009.1"}], "defaultStatus": "unknown"}]}], "published": "2025-09-16T15:15:41.780", "references": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/intersystems_cache.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/16807", "source": "disclosure@vulncheck.com"}, {"url": "https://www.intersystems.com/products/cache/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.APP:INTERSYSTEMS-CACHE-OF.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/intersystems-cache-stack-buffer-overflow", "source": "disclosure@vulncheck.com"}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/intersystems_cache.rb", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.exploit-db.com/exploits/16807", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Cach\u00e9 2009.1. The vulnerability is triggered by sending a specially crafted HTTP GET request containing an oversized argument to the .csp handler. Due to insufficient bounds checking, the input overflows a stack buffer, allowing an attacker to overwrite control structures and execute arbitrary code. It is unknown if this vulnerability was patched and an affected version range remains undefined."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer basado en pila existe en el endpoint UtilConfigHome.csp de InterSystems Cach\u00e9 2009.1. La vulnerabilidad se activa al enviar una solicitud HTTP GET especialmente dise\u00f1ada que contiene un argumento de tama\u00f1o excesivo al gestor .csp. Debido a una comprobaci\u00f3n de l\u00edmites insuficiente, la entrada desborda un b\u00fafer de pila, permitiendo a un atacante sobrescribir estructuras de control y ejecutar c\u00f3digo arbitrario. Se desconoce si esta vulnerabilidad fue parcheada y un rango de versiones afectadas permanece indefinido."}], "lastModified": "2026-10-01T23:10:00.233", "sourceIdentifier": "disclosure@vulncheck.com"}