Strix
26.1K

CVE-2010-1938

UnknownEPSS 21.99%

Last modified

CVE-2010-1938 is a vulnerability of currently unknown severity. Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.. EPSS estimates a 21.99% chance of exploitation in the next 30 days.

Description

Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.

Metrics

EPSS Probability
21.99%

97.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
FreebsdFreebsd6Stable
FreebsdFreebsd6.4—
FreebsdFreebsd7.0—
FreebsdFreebsd7.0-release—
FreebsdFreebsd7.0_beta4—
FreebsdFreebsd7.0_releng—
FreebsdFreebsd7.1—
FreebsdFreebsd7.2—
FreebsdFreebsd8.0—
FreebsdFreebsd8.1-prerelease—
NrlOpie<= 2.4.1Test1
NrlOpie2.2—
NrlOpie2.3—
NrlOpie2.4—
NrlOpie2.10—
NrlOpie2.11—
NrlOpie2.21—
NrlOpie2.22—
NrlOpie2.32—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2010-1938?
Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.
How severe is CVE-2010-1938?
Severity scoring for CVE-2010-1938 is pending analysis. The EPSS model estimates a 21.99% probability of exploitation in the next 30 days.
How do I fix CVE-2010-1938?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2010-1938?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST