CVE-2004-2687: distcc 2.x Unauthenticated Remote Command Execution via Compilation Jobs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a public exploit module and an EPSS score near 0.88 makes this an urgent exposure wherever distcc is reachable.

What it is

distcc 2.x, including the version bundled with Xcode 1.5, executes compilation jobs received on its server port without authorization checks when access to that port is not restricted. A remote attacker can therefore run arbitrary commands on the distcc server. This is a high-severity, network-reachable flaw in a build-distribution service that is often exposed on internal networks.

Impact

An attacker gains remote command execution with the privileges of the distcc daemon, typically the build user, allowing full compromise of the build host and any credentials or source code it handles.

Attack surface

Reached over the network via the distcc server port (TCP 3632 by default); the CVSS vector AV:N/Au:N indicates no authentication is required, and no user interaction is described.

Exploitation

A public Metasploit module (distcc_exec) is referenced, and EPSS is 0.88195 (99.8th percentile), indicating very high predicted exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Upgrade to a distcc release that enforces authorization on compilation jobs, or apply the vendor fix referenced in the distcc security advisory.
• Restrict access to the distcc server port (default TCP 3632) with host firewalls or network ACLs so only trusted build clients can connect.
• Bind distcc to trusted interfaces only and avoid exposing it to untrusted or flat internal networks.
• Run the distcc daemon under a dedicated low-privilege account with no access to sensitive files or credentials.
• Monitor for and remove any unauthorized distcc listeners on hosts where the service is not required.

Detection

• Audit hosts for listening distcc services on TCP 3632 and verify which networks can reach them.
• Inspect distcc logs and process trees for compilation jobs that spawn unexpected child processes or shell commands.
• Alert on network connections to port 3632 from hosts outside the expected build-client set.
• Hunt for known distcc exploit payload patterns or Metasploit distcc_exec artifacts in network and host telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.