ID CVE-2010-1039
Summary Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
References
Vulnerable Configurations
  • cpe:2.3:a:hp:nfs\/oncplus:*:*:*:*:*:*:*:*
    cpe:2.3:a:hp:nfs\/oncplus:*:*:*:*:*:*:*:*
  • cpe:2.3:o:hp:hp-ux:b.11.11:*:*:*:*:*:*:*
    cpe:2.3:o:hp:hp-ux:b.11.11:*:*:*:*:*:*:*
  • cpe:2.3:o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
    cpe:2.3:o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
  • cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
    cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:1.3:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:1.3:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:2.2.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:2.2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:3.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:3.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:3.2:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:3.2:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:3.2.0:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:3.2.0:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:3.2.4:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:3.2.4:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:3.2.5:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:3.2.5:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.0:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.1.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.1.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.1.2:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.1.2:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.1.3:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.1.3:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.1.4:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.1.4:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.1.5:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.1.5:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.2:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.2:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.2.0:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.2.0:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.2.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.2.1.12:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.2.1.12:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.3:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.3:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.3.0:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.3.0:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.3.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.3.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.3.2:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.3.2:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:4.3.3:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:4.3.3:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.1.0.10:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.1.0.10:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.1l:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.1l:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.2.0:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.2.0:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.2.0.50:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.2.0.50:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.2.0.54:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.2.0.54:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.2.2:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.2.2:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.2_l:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.2_l:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:-:*:*:*:*:*:x64:*
    cpe:2.3:o:ibm:aix:-:*:*:*:*:*:x64:*
  • cpe:2.3:o:ibm:aix:-:*:*:*:*:*:x86:*
    cpe:2.3:o:ibm:aix:-:*:*:*:*:*:x86:*
  • cpe:2.3:o:ibm:aix:5:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:5.3:sp6:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:5.3:sp6:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*
  • cpe:2.3:o:ibm:aix:430:*:*:*:*:*:*:*
    cpe:2.3:o:ibm:aix:430:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:vios:1.4:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:vios:1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:vios:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:vios:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:vios:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:vios:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:ibm:vios:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:vios:2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:*
    cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 10-10-2018 - 19:55)
Impact:
Exploitability:
CWE CWE-134
CAPEC
  • String Format Overflow in syslog()
    This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.
  • Format String Injection
    An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
  • accepted 2015-04-20T04:00:14.108-04:00
    class vulnerability
    contributors
    • name Varun Narula
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Prashant Kumar
      organization Hewlett-Packard
    • name Mike Cokus
      organization The MITRE Corporation
    description Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
    family unix
    id oval:org.mitre.oval:def:11986
    status accepted
    submitted 2010-10-25T16:10:22.000-05:00
    title HP-UX Running ONCplus rpc.pcnfsd, Remote Denial of Service (DoS), Increase in Privilege
    version 50
  • accepted 2011-02-21T04:00:10.842-05:00
    class vulnerability
    contributors
    • name Varun Narula
      organization Hewlett-Packard
    • name R, Yamini Mohan
      organization Hewlett-Packard
    definition_extensions
    • comment IBM AIX 5300-09 is installed
      oval oval:org.mitre.oval:def:6306
    • comment IBM AIX 6100-02 is installed
      oval oval:org.mitre.oval:def:5685
    • comment IBM AIX 6100-03 is installed
      oval oval:org.mitre.oval:def:6736
    • comment IBM AIX 6100-04 is installed
      oval oval:org.mitre.oval:def:7373
    description Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
    family unix
    id oval:org.mitre.oval:def:12103
    status accepted
    submitted 2010-11-24T16:39:20.000-05:00
    title AIX rpc.pcnfsd integer overflow vulnerability.
    version 46
refmap via4
aixapar
  • IZ73590
  • IZ73599
  • IZ73681
  • IZ73757
  • IZ73874
  • IZ75369
  • IZ75440
  • IZ75465
bid 40248
bugtraq 20100520 HP-UX, IBM AIX, SGI IRIX Remote Vulnerability - CVE-2010-1039
confirm
hp
  • HPSBUX02523
  • SSRT100036
misc http://www.checkpoint.com/defense/advisories/public/2010/cpai-13-May.html
osvdb 64729
sectrack
  • 1023994
  • 1024016
secunia
  • 39835
  • 39911
vupen
  • ADV-2010-1199
  • ADV-2010-1211
  • ADV-2010-1212
  • ADV-2010-1213
xf hpux-nfsoncplus-privilege-escalation(58718)
Last major update 10-10-2018 - 19:55
Published 20-05-2010 - 17:30
Last modified 10-10-2018 - 19:55
Back to Top