CVE-2010-1039
published 2010-05-20CVE-2010-1039: Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and…
PriorityP268critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
20.17%
97.2th percentile
Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | nfs_oncplus | <= b.11.31_09 | — |
| ibm | aix | <= 5.3 | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for RPC calls targeting ONC RPC program number 150001 (PCNFSD), version 1, procedure 3 (PR_START) with malformed/format-string-containing directory name arguments. ↗
- →Alert on RPC requests to rpc.pcnfsd (program 150001) where string arguments contain format string specifiers (e.g., %n, %x, %s) in the directory name field. ↗
- →The exploit uses AUTH_UNIX credentials with UID/GID 0 (root) — flag unauthenticated or zero-credential RPC calls to PCNFSD program 150001. ↗
- →Inspect RPC portmapper/rpcbind traffic for registrations or lookups of program number 150001 on affected AIX, VIOS, HP-UX, and IRIX hosts. ↗
- ·Affected platforms span IBM AIX 6.1/5.3 and earlier, IBM VIOS 2.1/1.5 and earlier, HP HP-UX B.11.11/B.11.23/B.11.31 with NFS/ONCplus B.11.31_09 and earlier, and SGI IRIX 6.5 — detection rules should be scoped to these OS environments. ↗
- ·The exploit was specifically tested against AIX 6.1.0 and lower; behaviour on other affected platforms may differ and exploit reliability is not guaranteed across all listed versions. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Samba 4.5.2 - Symlink Race Permits Opening Files Outside Share Directory
exploitdb·2017-03-27·CVSS 3.5
CVE-2017-2619 [LOW] Samba 4.5.2 - Symlink Race Permits Opening Files Outside Share Directory
Samba 4.5.2 - Symlink Race Permits Opening Files Outside Share Directory
---
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1039
The Samba server is supposed to only grant access to configured share
directories unless "wide links" are enabled, in which case the server is allowed
to follow symlinks. The default (since CVE-2010-0926) is that wide links are
disabled.
smbd ensures that it isn't following symlinks by calling lstat() on every
path component, as can be seen in strace (in reaction to the request
"get a/b/c/d/e/f/g/h/i/j", where /public is the root directory of the share):
root@debian:/home/user# strace -e trace=file -p18954
Process 18954 attached
lstat("a/b/c/d/e/f/g/h/i/j", {st_mode=S_IFREG|0644, st_size=4, ...}) = 0
getcwd("/public", 4096) = 8
lstat("/pub
Exploit-DB
Apple Mail.app - Image Attachment Command Execution (Metasploit)
exploitdb·2011-03-05
CVE-2007-6165 Apple Mail.app - Image Attachment Command Execution (Metasploit)
Apple Mail.app - Image Attachment Command Execution (Metasploit)
---
##
# $Id: mailapp_image_exec.rb 10397 2010-09-20 15:59:46Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Mail.app Image Attachment Command Execution',
'Description' => %q{
This module exploits a command execution vulnerability in the
Mail.app application shipped with Mac OS X 10.5.0. This flaw was
patched in 10.4 in March of 2007, but reintroduced into the final
release of 10.5.
},
'License' => MSF_LICENSE,
'Author' => ['hdm', 'kf'],
'Version' => '$Revision: 1039
Exploit-DB
rpc.pcnfsd - Remote Format String
exploitdb·2010-07-18
CVE-2010-1039 rpc.pcnfsd - Remote Format String
rpc.pcnfsd - Remote Format String
---
/*************************************************************************
* Check Point Software Technologies - Vulnerability Discovery Team (VDT) *
* Rodrigo Rubira Branco - *
* *
* rpc.pcnfsd syslog format string vulnerability *
*************************************************************************/
#include
#include
#include
#include
#include
#define PCNFSD_PROG 150001
#define PCNFSD_VERS 1
#define PCNFSD_PR_INIT 2
#define PCNFSD_PR_START 3
struct cm_send {
char *s1;
char *s2;
};
struct cm_send2 {
char *s1;
char *s2;
};
struct cm_reply {
int i;
};
bool_t xdr_cm_send(XDR *xdrs, struct cm_send *objp)
{
if(!xdr_wrapstring(xdrs, &objp->s1))
return (FALSE);
if(!xdr_wrapstring(xdrs, &objp->s2))
return (FALSE);
return (TRUE);
}
bool_t xdr_cm_
No writeups or analysis indexed.
http://aix.software.ibm.com/aix/efixes/security/pcnfsd_advisory.aschttp://marc.info/?l=bugtraq&m=127428077629933&w=2http://osvdb.org/64729http://secunia.com/advisories/39835http://secunia.com/advisories/39911http://securitytracker.com/id?1024016http://www.checkpoint.com/defense/advisories/public/2010/cpai-13-May.htmlhttp://www.ibm.com/support/docview.wss?uid=isg1IZ73590http://www.ibm.com/support/docview.wss?uid=isg1IZ73599http://www.ibm.com/support/docview.wss?uid=isg1IZ73681http://www.ibm.com/support/docview.wss?uid=isg1IZ73757http://www.ibm.com/support/docview.wss?uid=isg1IZ73874http://www.ibm.com/support/docview.wss?uid=isg1IZ75369http://www.ibm.com/support/docview.wss?uid=isg1IZ75440http://www.ibm.com/support/docview.wss?uid=isg1IZ75465http://www.securityfocus.com/archive/1/511405/100/0/threadedhttp://www.securityfocus.com/bid/40248http://www.securitytracker.com/id?1023994http://www.vupen.com/english/advisories/2010/1199http://www.vupen.com/english/advisories/2010/1211http://www.vupen.com/english/advisories/2010/1212http://www.vupen.com/english/advisories/2010/1213http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=5088https://exchange.xforce.ibmcloud.com/vulnerabilities/58718https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11986https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12103http://aix.software.ibm.com/aix/efixes/security/pcnfsd_advisory.aschttp://marc.info/?l=bugtraq&m=127428077629933&w=2http://osvdb.org/64729http://secunia.com/advisories/39835http://secunia.com/advisories/39911http://securitytracker.com/id?1024016http://www.checkpoint.com/defense/advisories/public/2010/cpai-13-May.htmlhttp://www.ibm.com/support/docview.wss?uid=isg1IZ73590http://www.ibm.com/support/docview.wss?uid=isg1IZ73599http://www.ibm.com/support/docview.wss?uid=isg1IZ73681http://www.ibm.com/support/docview.wss?uid=isg1IZ73757http://www.ibm.com/support/docview.wss?uid=isg1IZ73874http://www.ibm.com/support/docview.wss?uid=isg1IZ75369http://www.ibm.com/support/docview.wss?uid=isg1IZ75440http://www.ibm.com/support/docview.wss?uid=isg1IZ75465http://www.securityfocus.com/archive/1/511405/100/0/threadedhttp://www.securityfocus.com/bid/40248http://www.securitytracker.com/id?1023994http://www.vupen.com/english/advisories/2010/1199http://www.vupen.com/english/advisories/2010/1211http://www.vupen.com/english/advisories/2010/1212http://www.vupen.com/english/advisories/2010/1213http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=5088https://exchange.xforce.ibmcloud.com/vulnerabilities/58718https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11986https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12103
2010-05-20
Published