CVE-2010-1039

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-05-20 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.

Affected products

HP Nfs/Oncplus: through b.11.31_09
IBM AIX: through 5.3; 1.2.1, 1.3, 2.2.1, 3.1, 3.2, 3.2.0 (+30)
IBM VIOS: through 1.5; 1.4, 2.1
Sgi Irix: 6.5

References

http://aix.software.ibm.com/aix/efixes/security/pcnfsd_advisory.asc
http://marc.info/?l=bugtraq&m=127428077629933&w=2
http://osvdb.org/64729
http://secunia.com/advisories/39835
http://secunia.com/advisories/39911
http://securitytracker.com/id?1024016
http://www.checkpoint.com/defense/advisories/public/2010/cpai-13-May.html
http://www.ibm.com/support/docview.wss?uid=isg1IZ73590
http://www.ibm.com/support/docview.wss?uid=isg1IZ73599
http://www.ibm.com/support/docview.wss?uid=isg1IZ73681
http://www.ibm.com/support/docview.wss?uid=isg1IZ73757
http://www.ibm.com/support/docview.wss?uid=isg1IZ73874

Get alerted when CVE-2010-1039 or the next vulnerability affects your stack