Unscored severity · published May 20, 2010
CVE-2010-1039
Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX…
–
CVSS
20.2%
EPSS
No
On KEV
Description
Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
Exploitation
Is it being used?
Exploit prediction (EPSS)20.2% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Aix · Ibm
through 5.3; 1.2.1; 1.3; 2.2.1; 3.1; 3.2; +31 more · source: NVD
IR
Irix · Sgi
6.5 · source: NVD
NF
Nfs/oncplus · HP
through b.11.31_09 · source: NVD
VI
Vios · Ibm
through 1.5; 1.4; 2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1039
aix.software.ibm.com
http://aix.software.ibm.com/aix/efixes/security/pcnfsd_advisory.asc
Vendor Advisory
http://marc.info/?l=bugtraq&m=127428077629933&w=2
osvdb.org
http://osvdb.org/64729
Vendor Advisory
http://secunia.com/advisories/39835
secunia.com
http://secunia.com/advisories/39911
securitytracker.com
http://securitytracker.com/id?1024016
More from Nfs/oncplus
–
CVE-2011-0896
Unspecified vulnerability in HP NFS/ONCplus B.11.31.10 and earlier on HP-UX B.11.31 allows remote authenticated users to cause a denial of service via unknown vectors