National Cyber Awareness System

Vulnerability Summary for CVE-2003-0252

Overview

Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#258564

Name: VU#258564

Hyperlink:http://www.kb.cert.org/vuls/id/258564

External Source: BUGTRAQ

Name: 20030715 [slackware-security] nfs-utils packages replaced (SSA:2003-195-01b)

Type: Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=105830921519513&w=2

External Source: XF

Name: nfs-utils-offbyone-bo(12600)

Hyperlink:http://xforce.iss.net/xforce/xfdb/12600

External Source: TURBO

Name: TLSA-2003-44

Hyperlink:http://www.turbolinux.com/security/TLSA-2003-44.txt

External Source: BID

Name: 8179

Hyperlink:http://www.securityfocus.com/bid/8179

External Source: REDHAT

Name: RHSA-2003:207

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-207.html

External Source: REDHAT

Name: RHSA-2003:206

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-206.html

External Source: SUSE

Name: SuSE-SA:2003:031

Hyperlink:http://www.novell.com/linux/security/advisories/2003_031_nfs_utils.html

External Source: DEBIAN

Name: DSA-349

Hyperlink:http://www.debian.org/security/2003/dsa-349

External Source: SUNALERT

Name: 1001262

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001262.1-1

External Source: SECTRACK

Name: 1007187

Hyperlink:http://securitytracker.com/id?1007187

External Source: SECUNIA

Name: 9259

Hyperlink:http://secunia.com/advisories/9259

External Source: BUGTRAQ

Name: 20030716 Immunix Secured OS 7+ nfs-utils update -- bugtraq

Type: Advisory

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=105839032403325&w=2

External Source: BUGTRAQ

Name: 20030714 Linux nfs-utils xlog() off-by-one bug

Type: Advisory

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=105820223707191&w=2

External Source: MISC

Name: http://isec.pl/vulnerabilities/isec-0010-linux-nfs-utils.txt

Hyperlink:http://isec.pl/vulnerabilities/isec-0010-linux-nfs-utils.txt

External Source: VULNWATCH

Name: 20030714 Reality of the rpc.mountd bug

Type: Advisory

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0024.html

External Source: VULNWATCH

Name: 20030714 Linux nfs-utils xlog() off-by-one bug

Type: Advisory

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0023.html

External Source: MANDRAKE

Name: MDKSA-2003:076

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2003:076

US Government Resource: oval:org.mitre.oval:def:443

Name: oval:org.mitre.oval:def:443

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:443

References to Check Content

Identifier:oval:org.mitre.oval:def:443

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:443