Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.

acm, a multi-player aerial combat simulation, uses a network protocol based on the same RPC implementation used in many C libraries. This implementation was found to contain an integer overflow vulnerability which could be exploited to execute arbitrary code.

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also contain a fix from Andreas Schwab to reduce linebuflen in parallel to bumping up the buffer pointer in the NSS DNS code.

An integer overflow bug has been discovered in the RPC library used by dietlibc, a libc optimized for small size, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the calloc, fread and fwrite code. They are also more strict regarding hostile DNS packets that could lead to a vulnerability otherwise.

These problems have been fixed in version 0.12-2.4 for the current stable distribution (woody) and in version 0.20-0cvs20020808 for the unstable distribution (sid). Debian 2.2 (potato) is not affected since it doesn't contain dietlibc packages.

An integer overflow bug has been discovered in the RPC library used by the Kerberos 5 administration system, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to a KDC host. It is believed that the attacker needs to be able to authenticate to the kadmin daemon for this attack to be successful. No exploits are known to exist yet.

An integer overflow bug has been discovered in the RPC library used by the OpenAFS database server, which is derived from the SunRPC library.
This bug could be exploited to crash certain OpenAFS servers (volserver, vlserver, ptserver, buserver) or to obtain unauthorized root access to a host running one of these processes. No exploits are known to exist yet.

A heap buffer overflow exists in the XDR decoder in glibc version 2.2.5 and earlier. XDR is a mechanism for encoding data structures for use with RPC, which is derived from Sun's RPC implementation which is likewise vulnerable to a heap overflow. Depending on the application, this vulnerability may be exploitable and could lead to arbitrary code execution. Thanks to Solar Designer for the patches used to correct this vulnerability.

The network authentication system in Kerberos 5 contains an RPC library that includes an XDR decoder derived from Sun's RPC implementation. This implemenation is vulnerable to a heap overflow.
With Kerberos, it is believed that an attacker would need to be able to successfully authenticate to kadmin to be able to exploit this vulnerability.

The remote host is missing the patch for the advisory SUSE-SA:2002:031 (glibc).


An integer overflow has been discovered in the xdr_array() function, contained in the Sun Microsystems RPC/XDR library, which is part of the glibc library package on all SUSE products. This overflow allows a remote attacker to overflow a buffer, leading to remote execution of arbitrary code supplied by the attacker.

There is no temporary workaround for this security problem other than disabling all RPC based server and client programs. The permanent solution is to update the glibc packages with the update packages listed below.

Updated Kerberos 5 packages are now available for Red Hat LInux Advanced Server. These updates fix a buffer overflow in the XDR decoder.

Sun RPC is a remote procedure call framework which allows clients to invoke procedures in a server process over a network. XDR is a mechanism for encoding data structures for use with RPC.

The Kerberos 5 network authentication system contains an RPC library which includes an XDR decoder derived from Sun's RPC implementation.
The Sun implementation was recently demonstrated to be vulnerable to a heap overflow. It is believed that the attacker needs to be able to authenticate to the kadmin daemon for this attack to be successful. No exploits are known to currently exist.

All users should upgrade to these errata packages which contain an updated version of Kerberos 5 which is not vulnerable to this issue.

Updated glibc packages are available which fix a buffer overflow in the XDR decoder and two vulnerabilities in the resolver functions.

[updated 8 aug 2002] Updated packages have been made available, as the original errata introduced a bug which could cause calloc() to crash on 32-bit platforms when passed a size of 0. These updated errata packages contain a patch to correct this bug.

The glibc package contains standard libraries which are used by multiple programs on the system. Sun RPC is a remote procedure call framework which allows clients to invoke procedures in a server process over a network. XDR is a mechanism for encoding data structures for use with RPC. NFS, NIS, and other network services that are built upon Sun RPC. The glibc package contains an XDR encoder/decoder derived from Sun's RPC implementation which was recently demonstrated to be vulnerable to a heap overflow.

An error in the calculation of memory needed for unpacking arrays in the XDR decoder can result in a heap buffer overflow in glibc 2.2.5 and earlier. Depending upon the application, this vulnerability may be exploitable and could lead to arbitrary code execution.
(CVE-2002-0391)

A buffer overflow vulnerability has been found in the way the glibc resolver handles the resolution of network names and addresses via DNS (as per Internet RFC 1011). Version 2.2.5 of glibc and earlier versions are affected. A system would be vulnerable to this issue if the 'networks' database in the /etc/nsswitch.conf file includes the 'dns' entry. By default, Red Hat Linux Advanced Server ships with 'networks' set to 'files' and is therefore not vulnerable to this issue. (CVE-2002-0684)

A related issue is a bug in the glibc-compat packages, which provide compatibility for applications compiled against glibc version 2.0.x.
Applications compiled against this version (such as those distributed with early Red Hat Linux releases 5.0, 5.1, and 5.2) could also be vulnerable to this issue. (CVE-2002-0651)

All users should upgrade to these errata packages which contain patches to the glibc libraries and therefore are not vulnerable to these issues.

Thanks to Solar Designer for providing patches for this issue.

The remote Sun rpc.cmsd has integer overflow problem in xdr_array. An attacker may use this flaw to execute arbitrary code on this host with the privileges rpc.cmsd is running as (typically, root), by sending a specially crafted request to this service.

ID	Name	Product	Family	Severity
15170	Debian DSA-333-1 : acm - integer overflow	Nessus	Debian Local Security Checks	critical
14986	Debian DSA-149-1 : glibc - integer overflow	Nessus	Debian Local Security Checks	critical
14983	Debian DSA-146-2 : dietlibc - integer overflow	Nessus	Debian Local Security Checks	critical
14980	Debian DSA-143-1 : krb5 - integer overflow	Nessus	Debian Local Security Checks	critical
14979	Debian DSA-142-1 : openafs - integer overflow	Nessus	Debian Local Security Checks	critical
13962	Mandrake Linux Security Advisory : glibc (MDKSA-2002:061)	Nessus	Mandriva Local Security Checks	critical
13958	Mandrake Linux Security Advisory : krb5 (MDKSA-2002:057)	Nessus	Mandriva Local Security Checks	critical
13753	SUSE-SA:2002:031: glibc	Nessus	SuSE Local Security Checks	critical
12320	RHEL 2.1 : krb5 (RHSA-2002:173)	Nessus	Red Hat Local Security Checks	critical
12318	RHEL 2.1 : glibc (RHSA-2002:167)	Nessus	Red Hat Local Security Checks	critical
11418	Sun rpc.cmsd Remote Overflow	Nessus	RPC	critical

Detections

Analytics

CVE-2002-0391

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical