CVE-2003-1289

CVE-2003-1289 describes a memory disclosure vulnerability in the iBCS2 system call translator for statfs, affecting NetBSD versions 1.5 through 1.5.3 and FreeBSD versions 4 up to 4.8-RELEASE-p2 and 5 up to 5.1-RELEASE-p1. A local attacker can exploit this by providing a large length parameter, causing the system to copy portions of kernel memory into userland memory. The vulnerability has a low severity CVSS score of 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N), indicating local access, low attack complexity, and a potential impact of partial confidentiality loss. There is no evidence of active exploitation, no known exploit code in Metasploit or ExploitDB, and minimal community discussion or media coverage.