CVE-2010-2061 — Improper Input Validation in Rpcbind

CWE-20 — Improper Input Validation7 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 81.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rpcbind Project RpcbindRpcbind
Timeline
PublishedOct 29
Latest updateApr 21

Description

rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attacker before the daemon is started.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶Debianrpcbind_project/rpcbind< 0.2.0-4.1+3
▶CVEListV5rpcbind/rpcbind0.2.0

🔴Vulnerability Details

3
GHSA
GHSA-hggq-vwrr-h5xv: rpcbind 0↗2022-04-21
▶
CVEList
CVE-2010-2061: rpcbind 0↗2019-10-29
▶
OSV
CVE-2010-2061: rpcbind 0↗2019-10-29
▶

📋Vendor Advisories

2
Red Hat
rpcbind: Insecure (predictable) temporary file use↗2010-05-27
▶
Debian
CVE-2010-2061: rpcbind - rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbi...↗2010
▶

💬Community

1
Bugzilla
CVE-2010-2061 CVE-2010-2064 rpcbind: Insecure (predictable) temporary file use↗2010-06-03
▶
CVE-2010-2061 — Improper Input Validation in Rpcbind | cvebase