LiveActive security incident?Get immediate response
CVE Record

CVE-2019-1010060: NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow.

NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CFITSIO, a NASA library for FITS scientific data files, had buffer overflows before version 3.43. Sources state remote unauthenticated attackers could achieve arbitrary code execution. Business risk is highest where services automatically process untrusted FITS-related data or bundle older CFITSIO versions.

Executive priority

Prioritize remediation for internet-facing or automated scientific data services using CFITSIO before 3.43. Internal-only research workstations are lower urgency but still need inventory and planned upgrade because the stated impact is code execution.

Technical view

CVE-2019-1010060 covers CFITSIO issues fixed in 3.43 and not covered by several 2018 CVEs. The record describes buffer overflow flaws across many source files, including a drvrnet.c ftp_status long-string handling issue. No CVSS vector, CWE, or KEV exploitation evidence is provided.

Likely exposure

Exposure is likely in software that embeds or links NASA CFITSIO before 3.43, especially scientific processing pipelines, web services, or automation that accepts remote or unauthenticated FITS data. Downstream packages may carry patched backports, so version and vendor package status both matter.

Exploitation context

The source bundle says the attack vector is remote and unauthenticated with potential arbitrary code execution. It does not provide evidence of active exploitation, and CISA KEV status is false. Treat public-facing or automated ingestion paths as higher priority until version status is confirmed.

Researcher notes

Evidence is limited: the CVE describes broad code changes and one example issue, but lacks CVSS, CWE, affected CPEs, and exploit-status details. Analysis should focus on version confirmation, downstream packaging, static linking, and whether untrusted remote inputs reach CFITSIO parsing or network driver code.

Mitigation direction

  • Upgrade CFITSIO to 3.43 or a vendor-confirmed fixed build.
  • Update applications or packages that bundle CFITSIO internally.
  • Check distribution advisories for backported security fixes.
  • Limit unauthenticated processing of untrusted FITS data until upgraded.
  • Rebuild dependent services against the fixed library where statically linked.

Validation and detection

  • Inventory deployed CFITSIO library and package versions.
  • Check whether any applications bundle CFITSIO before 3.43.
  • Confirm runtime linkage uses the fixed library, not an older copy.
  • Review public or automated FITS ingestion paths.
  • Verify vendor package changelogs if version numbers are backported.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-1010060 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
NASACFITSIO< 3.43 [fixed: 3.43]Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.