[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 402/03 - Debian - buffer overflow in nfs-utils



 
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 402/03 dated 15.07.03  Time: 10:00
 UNIRAS is part of NISCC(National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Debian Security Advisory:

buffer overflow in nfs-utils

Detail
====== 

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------------
Debian Security Advisory DSA 349-1                     security@xxxxxxxxxx
http://www.debian.org/security/                             Matt Zimmerman
July 14th, 2003                          http://www.debian.org/security/faq
- - --------------------------------------------------------------------------

Package        : nfs-utils
Vulnerability  : buffer overflow
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CAN-2003-0252

The logging code in nfs-utils contains an off-by-one buffer overrun
when adding a newline to the string being logged.  This vulnerability
may allow an attacker to execute arbitrary code or cause a denial of
service condition by sending certain RPC requests.

For the stable distribution (woody) this problem has been fixed in
version 1:1.0-2woody1.

For the unstable distribution (sid) this problem has been fixed in
version 1:1.0.3-2.

We recommend that you update your nfs-utils package.

Upgrade Instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- - --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody1.dsc
      Size/MD5 checksum:      547 a4c33f7a535608512f31b7ee34d4272e
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody1.tar.gz
      Size/MD5 checksum:   240859 5c573fee27a1e10ff7f664b4bdf732a2

  Alpha architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_alpha.deb
      Size/MD5 checksum:    52698 29882fb7f6fd28f81f815ed562ac68a7
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_alpha.deb
      Size/MD5 checksum:    79386 49ff8885c51710a768cd93f6dd649d71
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_alpha.deb
      Size/MD5 checksum:    36662 0dc3e1ba2c91f2232e3fcb20918057e4

  ARM architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_arm.deb
      Size/MD5 checksum:    44804 296f0f554fd1cf4b59d9ea1cdab9321d
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_arm.deb
      Size/MD5 checksum:    67516 f3bea88a8d1ba73a2534b8c0bd7c423c
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_arm.deb
      Size/MD5 checksum:    34344 3c266dc34f4ac4be196b499c5eef3975

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_i386.deb
      Size/MD5 checksum:    44400 233409f10f8767e36f6ad10072ede8ab
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_i386.deb
      Size/MD5 checksum:    66596 07ea3180828ef48a92c58855d9b5b54a
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_i386.deb
      Size/MD5 checksum:    33482 11d03d87740fb81054b46a859741d77c

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_ia64.deb
      Size/MD5 checksum:    58974 33483f9fe4df2b84cb26d4e1cd76fc91
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_ia64.deb
      Size/MD5 checksum:    93340 eb51718186119e3b73d193c4eb7f5707
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_ia64.deb
      Size/MD5 checksum:    41470 3ad514dec2b983446a2fb704e56be337

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_hppa.deb
      Size/MD5 checksum:    49896 9444fd4edfbb2abbcf83e838fda6d214
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_hppa.deb
      Size/MD5 checksum:    74924 2270c3317f7453cec6966e2e16147d42
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_hppa.deb
      Size/MD5 checksum:    36746 3f10fa97c70fa41776f874e670e57642

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_m68k.deb
      Size/MD5 checksum:    43548 1896cab837cdfaabdcb728668e6f0273
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_m68k.deb
      Size/MD5 checksum:    64216 822c887cd14d049528029f36cc1a2240
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_m68k.deb
      Size/MD5 checksum:    33168 11468a2b2cc746b6ed363fa481575124

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_mips.deb
      Size/MD5 checksum:    47534 2dc98eeed2317d0dfc7a564b4148491f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_mips.deb
      Size/MD5 checksum:    74732 eff1441d229295fecc3e46113763b242
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_mips.deb
      Size/MD5 checksum:    35674 e58f28fd4ed296573efda02226f68f78

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_mipsel.deb
      Size/MD5 checksum:    47672 4b4f9619231ee353a4a9585c5d25d97f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_mipsel.deb
      Size/MD5 checksum:    74758 5cb3ed2cc13787e8e4cec25bae4888fd
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_mipsel.deb
      Size/MD5 checksum:    35592 c0f83d36cbf8ce91068aab57b67e27e3

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_powerpc.deb
      Size/MD5 checksum:    45836 2403d7768e90f4816f352e709c170db6
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_powerpc.deb
      Size/MD5 checksum:    68946 7f02fb3dff57fc7653748a2b4596495d
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_powerpc.deb
      Size/MD5 checksum:    34400 c6f488e6dd8fda796e4deaaa27b88efc

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_s390.deb
      Size/MD5 checksum:    46006 96b6534bda89d5972f2abb3810b7c54b
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_s390.deb
      Size/MD5 checksum:    70004 52f4f090ad8cd97e8703806ba6af1db8
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_s390.deb
      Size/MD5 checksum:    34536 921a9d188d539b82cd671f910aff0c26

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_sparc.deb
      Size/MD5 checksum:    51968 8e9df57876f846d04ca688b28d9434f6
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_sparc.deb
      Size/MD5 checksum:    76244 cdafde849c69da57312aedf4b0e564cf
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_sparc.deb
      Size/MD5 checksum:    36928 726481a036653add593ed2a009ac7d6d

  These files will probably be moved into the stable distribution on
  its next revision.

- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/EvnsArxCt0PiXR4RAiGCAJ0eth2ou3NEZP62AMErsEItnJY8+wCfUyfC
ibmaMk/3TECkwSeVfNDurlE=
=HfDv
- -----END PGP SIGNATURE-----

- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via EMail to:
uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 20 7821 1330 Ext 4511
Fax: +44 (0) 20 7821 1686

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 20 7821 1330 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Debian for the information
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQCVAwUBPxPD/4pao72zK539AQESAAP/fMQ5KFXDEmJwkp0A6W9puZa7bVkGZdq3
Z+MLgRR4hTiUj0CE97b1+x+ddopvgBqmdbYr/HH2Oskaw46j//iCWLqp3Z5+zoxk
BCdKZNov+aPuS8FtpVDCjZ867AUqI5vDJ2QhpGnM+9nSqumtEWpuWTIktDan3Rth
rhZOZBHMlyg=
=dmpz
-----END PGP SIGNATURE-----