(Immunix Issues Fix) 'nfs-utils' Buffer Overflow May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1007210 |
|
SecurityTracker URL: http://securitytracker.com/id/1007210
|
|
CVE Reference:
CVE-2003-0252
(Links to External Site)
|
Date: Jul 16 2003
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.0.3 and prior versions
|
Description:
An off-by one buffer overflow vulnerability was reported in 'nfs-utils'. A remote user may be able to execute arbitrary code on the target system.
Janusz Niewiadomski of iSEC Security Research reported that a remote user can send a specially crafted request to the rpc.mountd daemon to trigger an overflow in the xlog() logging function. If the user-supplied string is 1023 bytes or longer, the trailing null '\0' byte is written beyond the end of the buffer.
According to the report, a remote user can cause the daemon to crash or execute arbitrary code with the privileges of the daemon. However, Red Hat reported in advisory RHSA-2003:206-01 that "it is not believed that this bug could lead to remote arbitrary code execution."
|
Impact:
A remote user can send a specially crafted NFS request to cause the rpc.mountd daemon to crash or execute arbitrary code. The arbitrary code will run with the privileges of the daemon.
|
Solution:
Immunix has released a fix. According to the advisory, StackGuard may not be able to prevent exploitation of this vulnerability because the overflow is small.
Binary packages:
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/nfs-utils-0.3.1-7_imnx_3.i386.rpm
Source packages:
http://download.immunix.org/ImmunixOS/7+/Updates/SRPMS/nfs-utils-0.3.1-7_imnx_3.src.rpm
Immunix OS 7+ md5sums:
61b6c75291f772e6b6fa7f53284a6021 RPMS/nfs-utils-0.3.1-7_imnx_3.i386.rpm
8f1067f0acfe49ba0bb8d88da5bd7f30 SRPMS/nfs-utils-0.3.1-7_imnx_3.src.rpm
|
Vendor URL: sourceforge.net/projects/nfs/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Immunix)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 15 Jul 2003 17:10:58 -0700
Subject: [Immunix-announce] Immunix Secured OS 7+ nfs-utils update -- immunix
|
--===============35152599687612796==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="QXO0/MSS4VvK6f+D"
Content-Disposition: inline
--QXO0/MSS4VvK6f+D
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
[Please do not set vacation autoreplies to public mail lists. It is
very rude. Please do not tell us our gpg signature is a virus. It is
not. Thank you.]
-----------------------------------------------------------------------
Immunix Secured OS Security Advisory
Packages updated: nfs-utils
Affected products: Immunix OS 7+
Bugs fixed: CAN-2003-0252
Date: Mon Jul 14 2003
Advisory ID: IMNX-2003-7+-018-01
Author: Seth Arnold <sarnold@immunix.com>
-----------------------------------------------------------------------
Description:
Janusz Niewiadomski has discovered an off-by-one overflow in xlog() in
the nfs-utils package. It is rumoured this bug is exploitable, however
as it writes a single zero byte to memory, an exploit may be difficult
to write.
Because the overflow is so small, StackGuard may not be able to
prevent exploitation of this flaw.
References: http://www.securityfocus.com/archive/1/328946
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0252
Package names and locations:
Precompiled binary packages for Immunix 7+ are available at:
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/nfs-utils-0.3.1-7_i=
mnx_3.i386.rpm
Source packages for Immunix 7+ are available at:
http://download.immunix.org/ImmunixOS/7+/Updates/SRPMS/nfs-utils-0.3.1-7_=
imnx_3.src.rpm
Immunix OS 7+ md5sums:
61b6c75291f772e6b6fa7f53284a6021 RPMS/nfs-utils-0.3.1-7_imnx_3.i386.rpm
8f1067f0acfe49ba0bb8d88da5bd7f30 SRPMS/nfs-utils-0.3.1-7_imnx_3.src.rpm
GPG verification: =
=20
Our public key is available at http://download.immunix.org/GPG_KEY
NOTE:
Ibiblio is graciously mirroring our updates, so if the links above are
slow, please try:
ftp://ftp.ibiblio.org/pub/Linux/distributions/immunix/
or one of the many mirrors available at:
http://www.ibiblio.org/pub/Linux/MIRRORS.html
ImmunixOS 6.2 is no longer officially supported.
ImmunixOS 7.0 is no longer officially supported.
Contact information:
To report vulnerabilities, please contact security@immunix.com.
Immunix attempts to conform to the RFP vulnerability disclosure protocol
http://www.wiretrip.net/rfp/policy.html.
--QXO0/MSS4VvK6f+D
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAj8UmBIACgkQVQcWL60UVMuK3wCfacKBZ8hA92qgrXo6QGSP1arn
TG8Ani87VdM27hSNxrRpBDg4P9DBbHmQ
=l7Gg
-----END PGP SIGNATURE-----
--QXO0/MSS4VvK6f+D--
--===============35152599687612796==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Immunix-announce mailing list
Immunix-announce@wirex.com
http://mail.wirex.com/mailman/listinfo/immunix-announce
--===============35152599687612796==--
|
|
