Message-ID: <20030714184706.GS5164@alcor.net>
From: debian-security-announce at lists.debian.org (debian-security-announce@...ts.debian.org)
Subject: [SECURITY] [DSA-349-1] New nfs-utils package fixes buffer overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 349-1                     security@...ian.org
http://www.debian.org/security/                             Matt Zimmerman
July 14th, 2003                          http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : nfs-utils
Vulnerability  : buffer overflow
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CAN-2003-0252

The logging code in nfs-utils contains an off-by-one buffer overrun
when adding a newline to the string being logged.  This vulnerability
may allow an attacker to execute arbitrary code or cause a denial of
service condition by sending certain RPC requests.

For the stable distribution (woody) this problem has been fixed in
version 1:1.0-2woody1.

For the unstable distribution (sid) this problem has been fixed in
version 1:1.0.3-2.

We recommend that you update your nfs-utils package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody1.dsc
      Size/MD5 checksum:      547 a4c33f7a535608512f31b7ee34d4272e
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody1.tar.gz
      Size/MD5 checksum:   240859 5c573fee27a1e10ff7f664b4bdf732a2

  Alpha architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_alpha.deb
      Size/MD5 checksum:    52698 29882fb7f6fd28f81f815ed562ac68a7
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_alpha.deb
      Size/MD5 checksum:    79386 49ff8885c51710a768cd93f6dd649d71
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_alpha.deb
      Size/MD5 checksum:    36662 0dc3e1ba2c91f2232e3fcb20918057e4

  ARM architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_arm.deb
      Size/MD5 checksum:    44804 296f0f554fd1cf4b59d9ea1cdab9321d
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_arm.deb
      Size/MD5 checksum:    67516 f3bea88a8d1ba73a2534b8c0bd7c423c
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_arm.deb
      Size/MD5 checksum:    34344 3c266dc34f4ac4be196b499c5eef3975

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_i386.deb
      Size/MD5 checksum:    44400 233409f10f8767e36f6ad10072ede8ab
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_i386.deb
      Size/MD5 checksum:    66596 07ea3180828ef48a92c58855d9b5b54a
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_i386.deb
      Size/MD5 checksum:    33482 11d03d87740fb81054b46a859741d77c

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_ia64.deb
      Size/MD5 checksum:    58974 33483f9fe4df2b84cb26d4e1cd76fc91
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_ia64.deb
      Size/MD5 checksum:    93340 eb51718186119e3b73d193c4eb7f5707
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_ia64.deb
      Size/MD5 checksum:    41470 3ad514dec2b983446a2fb704e56be337

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_hppa.deb
      Size/MD5 checksum:    49896 9444fd4edfbb2abbcf83e838fda6d214
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_hppa.deb
      Size/MD5 checksum:    74924 2270c3317f7453cec6966e2e16147d42
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_hppa.deb
      Size/MD5 checksum:    36746 3f10fa97c70fa41776f874e670e57642

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_m68k.deb
      Size/MD5 checksum:    43548 1896cab837cdfaabdcb728668e6f0273
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_m68k.deb
      Size/MD5 checksum:    64216 822c887cd14d049528029f36cc1a2240
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_m68k.deb
      Size/MD5 checksum:    33168 11468a2b2cc746b6ed363fa481575124

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_mips.deb
      Size/MD5 checksum:    47534 2dc98eeed2317d0dfc7a564b4148491f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_mips.deb
      Size/MD5 checksum:    74732 eff1441d229295fecc3e46113763b242
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_mips.deb
      Size/MD5 checksum:    35674 e58f28fd4ed296573efda02226f68f78

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_mipsel.deb
      Size/MD5 checksum:    47672 4b4f9619231ee353a4a9585c5d25d97f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_mipsel.deb
      Size/MD5 checksum:    74758 5cb3ed2cc13787e8e4cec25bae4888fd
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_mipsel.deb
      Size/MD5 checksum:    35592 c0f83d36cbf8ce91068aab57b67e27e3

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_powerpc.deb
      Size/MD5 checksum:    45836 2403d7768e90f4816f352e709c170db6
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_powerpc.deb
      Size/MD5 checksum:    68946 7f02fb3dff57fc7653748a2b4596495d
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_powerpc.deb
      Size/MD5 checksum:    34400 c6f488e6dd8fda796e4deaaa27b88efc

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_s390.deb
      Size/MD5 checksum:    46006 96b6534bda89d5972f2abb3810b7c54b
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_s390.deb
      Size/MD5 checksum:    70004 52f4f090ad8cd97e8703806ba6af1db8
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_s390.deb
      Size/MD5 checksum:    34536 921a9d188d539b82cd671f910aff0c26

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody1_sparc.deb
      Size/MD5 checksum:    51968 8e9df57876f846d04ca688b28d9434f6
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody1_sparc.deb
      Size/MD5 checksum:    76244 cdafde849c69da57312aedf4b0e564cf
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody1_sparc.deb
      Size/MD5 checksum:    36928 726481a036653add593ed2a009ac7d6d

  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/EvnsArxCt0PiXR4RAiGCAJ0eth2ou3NEZP62AMErsEItnJY8+wCfUyfC
ibmaMk/3TECkwSeVfNDurlE=
=HfDv
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists