CVE-2010-2064 — Link Following in Rpcbind

CWE-59 — Link Following7 documents7 sources
Severity
7.1HIGHNVD
EPSS
0.1%
top 78.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rpcbind Project RpcbindRpcbind
Timeline
PublishedOct 29
Latest updateApr 21

Description

rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.8 | Impact: 5.2

Affected Packages3 packages

▶Debianrpcbind_project/rpcbind< 0.2.0-4.1+3
▶CVEListV5rpcbind/rpcbind0.2.0

🔴Vulnerability Details

3
GHSA
GHSA-43c2-9xgq-4pm4: rpcbind 0↗2022-04-21
▶
OSV
CVE-2010-2064: rpcbind 0↗2019-10-29
▶
CVEList
CVE-2010-2064: rpcbind 0↗2019-10-29
▶

📋Vendor Advisories

2
Red Hat
rpcbind: Insecure (predictable) temporary file use↗2010-05-27
▶
Debian
CVE-2010-2064: rpcbind - rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges ...↗2010
▶

💬Community

1
Bugzilla
CVE-2010-2061 CVE-2010-2064 rpcbind: Insecure (predictable) temporary file use↗2010-06-03
▶
CVE-2010-2064 — Link Following in Rpcbind | cvebase