Description
Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- rpc.pcnfsd - Remote Format String EDB-14407 · remote · Jul 18, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 64729 vdb-entry
- IZ75440 vendor-advisory
- 39911 third-party-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=5088
- oval:org.mitre.oval:def:11986 vdb-entry signature
- 40248 vdb-entry
- 1023994 vdb-entry
- IZ75369 vendor-advisory
- ADV-2010-1213 vdb-entry
- IZ73757 vendor-advisory
- IZ73599 vendor-advisory
- http://www.checkpoint.com/defense/advisories/public/2010/cpai-13-May.html
- 20100520 HP-UX, IBM AIX, SGI IRIX Remote Vulnerability - CVE-2010-1039 mailing-list
- HPSBUX02523 vendor-advisory
- oval:org.mitre.oval:def:12103 vdb-entry signature
- IZ75465 vendor-advisory
- IZ73874 vendor-advisory
- ADV-2010-1199 vdb-entry
- 39835 third-party-advisory
- hpux-nfsoncplus-privilege-escalation(58718) vdb-entry
- 1024016 vdb-entry
- ADV-2010-1212 vdb-entry
- ADV-2010-1211 vdb-entry
- http://aix.software.ibm.com/aix/efixes/security/pcnfsd_advisory.asc
- IZ73590 vendor-advisory
- IZ73681 vendor-advisory