GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2010-1938

Vulnerability from fkie_nvd - Published: 2010-05-28 18:30 - Updated: 2026-06-16 23:19
Severity
Summary
Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.
References
cve@mitre.orghttp://blog.pi3.com.pl/?p=111
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584932
cve@mitre.orghttp://secunia.com/advisories/39963Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/39966Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/45136
cve@mitre.orghttp://security.FreeBSD.org/advisories/FreeBSD-SA-10:05.opie.ascVendor Advisory
cve@mitre.orghttp://securityreason.com/achievement_securityalert/87
cve@mitre.orghttp://securityreason.com/securityalert/7450
cve@mitre.orghttp://securitytracker.com/id?1024040
cve@mitre.orghttp://securitytracker.com/id?1025709
cve@mitre.orghttp://site.pi3.com.pl/adv/libopie-adv.txt
cve@mitre.orghttp://www.debian.org/security/2011/dsa-2281
cve@mitre.orghttp://www.exploit-db.com/exploits/12762
cve@mitre.orghttp://www.securityfocus.com/bid/40403
af854a3a-2127-422b-91ae-364da2661108http://blog.pi3.com.pl/?p=111
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584932
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/39963Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/39966Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/45136
af854a3a-2127-422b-91ae-364da2661108http://security.FreeBSD.org/advisories/FreeBSD-SA-10:05.opie.ascVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/achievement_securityalert/87
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/7450
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1024040
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1025709
af854a3a-2127-422b-91ae-364da2661108http://site.pi3.com.pl/adv/libopie-adv.txt
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2011/dsa-2281
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/12762
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/40403
Impacted products
Vendor Product Version
freebsd freebsd 6
freebsd freebsd 6.4
freebsd freebsd 6.4
freebsd freebsd 6.4
freebsd freebsd 6.4
freebsd freebsd 6.4
freebsd freebsd 6.4
freebsd freebsd 6.4
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0
freebsd freebsd 7.0-release
freebsd freebsd 7.0_beta4
freebsd freebsd 7.0_releng
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.1
freebsd freebsd 7.2
freebsd freebsd 7.2
freebsd freebsd 7.2
freebsd freebsd 8.0
freebsd freebsd 8.1-prerelease
nrl opie *
nrl opie 2.2
nrl opie 2.3
nrl opie 2.4
nrl opie 2.10
nrl opie 2.11
nrl opie 2.21
nrl opie 2.22
nrl opie 2.32
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6:stable:*:*:*:*:*:*",
              "matchCriteriaId": "F135D976-52FD-477A-B3C3-9CDDB79ACCBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4F7F02A-C845-40BF-8490-510A070000F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6.4:release:*:*:*:*:*:*",
              "matchCriteriaId": "53D1AD5E-4007-4AFA-A18B-69D1AC055C00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6.4:release_p2:*:*:*:*:*:*",
              "matchCriteriaId": "06BFEE54-DBF3-4546-AE57-2C25FC9F0F04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6.4:release_p3:*:*:*:*:*:*",
              "matchCriteriaId": "BE1FC1A8-E499-45A0-B89A-5BFA24727DBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6.4:release_p4:*:*:*:*:*:*",
              "matchCriteriaId": "8E08DCB9-9064-4DB7-B43A-7B415882EB50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6.4:release_p5:*:*:*:*:*:*",
              "matchCriteriaId": "E4A5E6FF-617E-4173-A948-F3728454A012",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:6.4:stable:*:*:*:*:*:*",
              "matchCriteriaId": "06FB0EEA-254E-4A1F-99E7-058FCD518E22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "47E0A416-733A-4616-AE08-150D67FCEA70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:beta_4:*:*:*:*:*:*",
              "matchCriteriaId": "CDFA5AA9-E73F-448D-9754-41AF9AECB93A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:current:*:*:*:*:*:*",
              "matchCriteriaId": "C4E775BA-6DC1-4006-83A4-D30EA57417FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:pre-release:*:*:*:*:*:*",
              "matchCriteriaId": "42231BCC-2B90-4196-A1C2-408A353C1BEF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:release:*:*:*:*:*:*",
              "matchCriteriaId": "EF8CCA19-1CBF-406F-AF84-00E803423195",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:release-p12:*:*:*:*:*:*",
              "matchCriteriaId": "0452688A-3E71-4BC9-8942-56ABBC47EA87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:release-p8:*:*:*:*:*:*",
              "matchCriteriaId": "510ABA29-1AAA-4279-BAD2-B4624DC60A11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:release-p9:*:*:*:*:*:*",
              "matchCriteriaId": "7A6C0249-951F-4352-92B2-E6A6CD5F26FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:releng:*:*:*:*:*:*",
              "matchCriteriaId": "C3556FE9-9949-4B8E-9E51-1205220B1A10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0:stable:*:*:*:*:*:*",
              "matchCriteriaId": "799D4A5E-7BF1-4B04-89DB-5C929938847B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0-release:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC290462-4364-464F-8CE9-6F5E5BE6F246",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0_beta4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F06B831E-D8F2-4380-B279-559CE103210F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.0_releng:*:*:*:*:*:*:*",
              "matchCriteriaId": "3ACC9072-4A33-4F1F-B790-2F9D5A52F71B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "803EFA9F-B7CB-4511-B1C1-381170CA9A23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:pre-release:*:*:*:*:*:*",
              "matchCriteriaId": "14D72C9B-EEB0-4605-BEA2-F77092129245",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "52DBF406-9C77-4DDA-AB7D-40FAE40023D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:release-p1:*:*:*:*:*:*",
              "matchCriteriaId": "20A31C9A-A928-4C9B-BB49-0E53227746DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:release-p2:*:*:*:*:*:*",
              "matchCriteriaId": "99FB7443-F942-402A-9104-64677EAF014E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:release-p4:*:*:*:*:*:*",
              "matchCriteriaId": "305A4C3D-C63D-4D1F-80FF-549182A0D9B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:release-p5:*:*:*:*:*:*",
              "matchCriteriaId": "C2A31704-E99F-4DBE-ABA4-EC3E566DE6CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:release-p6:*:*:*:*:*:*",
              "matchCriteriaId": "E634CDF4-F77B-4917-A452-907A771B5B0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.1:stable:*:*:*:*:*:*",
              "matchCriteriaId": "E9A75104-5A3E-485E-B4EC-0873C942731C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F948527C-A01E-4315-80B6-47FACE18A34F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.2:pre-release:*:*:*:*:*:*",
              "matchCriteriaId": "8B573401-DC6F-4AFE-92F5-D96F785D2107",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:7.2:stable:*:*:*:*:*:*",
              "matchCriteriaId": "60D40129-108B-421B-9990-6C6F381C96AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CF1F9EF-01AF-4708-AE02-765360AF3D66",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:8.1-prerelease:*:*:*:*:*:*:*",
              "matchCriteriaId": "B525B32B-417E-49C8-9847-A9F807FA67B0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nrl:opie:*:test1:*:*:*:*:*:*",
              "matchCriteriaId": "AEEC73FC-2BB6-4B8F-9596-BBB287AFFDA2",
              "versionEndIncluding": "2.4.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D33B387-8EE6-4F36-A4B5-509FF8DA8C1E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9B3734D-F6CB-4242-92FA-EDF425CCBCEF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2B076A0-0216-4A52-ABA6-2E511FB6DB5E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "32B7BBAB-609B-4D4D-BF5A-C4E95F0A8C51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "5889C86D-4285-4B22-B3F0-76984D8CEC4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0779EF0-9638-474E-9EF2-971ADA10F1D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AEB7E9A-3F68-4F20-A073-751A76452C67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nrl:opie:2.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9A53F58-7514-4B07-AC56-C6F928F9D3F3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd."
    },
    {
      "lang": "es",
      "value": "Error Off-by-oneen en la funci\u00f3n __opiereadrec en readrec.c en libopie en OPIE v2.4.1-test1 y anteriores, utilizada en FreeBSD v6.4 hasta v8.1-PRERELEASE y otras plataformas, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda del demonio) o posiblemente ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un nombre de usuraio largo, como se ha demostrado mediante un comando USER largo en el ftpd FreeBSD v8.0."
    }
  ],
  "id": "CVE-2010-1938",
  "lastModified": "2026-06-16T23:19:37.547",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-05-28T18:30:01.470",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://blog.pi3.com.pl/?p=111"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584932"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/39963"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/39966"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/45136"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-10:05.opie.asc"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/achievement_securityalert/87"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/7450"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1024040"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1025709"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://site.pi3.com.pl/adv/libopie-adv.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2011/dsa-2281"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.exploit-db.com/exploits/12762"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/40403"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blog.pi3.com.pl/?p=111"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584932"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/39963"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/39966"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/45136"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-10:05.opie.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/achievement_securityalert/87"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/7450"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1024040"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1025709"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://site.pi3.com.pl/adv/libopie-adv.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2011/dsa-2281"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.exploit-db.com/exploits/12762"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/40403"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.