Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.

The logging code in nfs-utils contains an off-by-one buffer overrun when adding a newline to the string being logged. This vulnerability may allow an attacker to execute arbitrary code or cause a denial of service condition by sending certain RPC requests.

An off-by-one buffer overflow was found in the logging code in nfs-utils when adding a newline to the string being logged. This could allow an attacker to execute arbitrary code or cause a DoS (Denial of Service) on the server by sending certain RPC requests.

The remote host is missing the patch for the advisory SUSE-SA:2003:031 (nfs-utils).


The nfs-utils package contains various programs to offer and manage certain RPC services such as the rpc.mountd.
iSEC Security Research has reported an off-by-one bug in the xlog() function used by the rpc.mountd. It is possible for remote attackers to use this off-by-one overflow to execute arbitrary code as root.
Some of the products listed above seem not vulnerable to this one byte overflow due to the stack alignment generated by the compiler during the build. Nevertheless, since there is no easy workaround except shutting down the RPC services, an update is strongly recommended for every product listed above.

This update needs to be applied to both NFS servers and clients, as the vulnerable function is used by mountd and statd.

You can either restart these services manually, or use the corresponding init scripts:

'rcnfsserver restart'           (for the NFS server) 'rcnfs restart'                 (for the NFS client)

Depending on your setup, it may be less disruptive to restart the two daemons manually.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated nfs-utils packages are available that fix a remotely exploitable Denial of Service vulnerability.

The nfs-utils package provides a daemon for the kernel NFS server and related tools.

Janusz Niewiadomski found a buffer overflow bug in nfs-utils version 1.0.3 and earlier. This bug could be exploited by an attacker, causing a remote Denial of Service (crash). It is not believed that this bug could lead to remote arbitrary code execution.

Users are advised to update to these erratum packages, which contain a backported security patch supplied by the nfs-utils maintainers and are not vulnerable to this issue.

The remote rpc.mountd daemon is vulnerable to an off-by-one overflow which could be exploited by an attacker to gain a root shell on this host.

ID	Name	Product	Family	Severity
15186	Debian DSA-349-1 : nfs-utils - buffer overflow	Nessus	Debian Local Security Checks	critical
14059	Mandrake Linux Security Advisory : nfs-utils (MDKSA-2003:076)	Nessus	Mandriva Local Security Checks	critical
13800	SUSE-SA:2003:031: nfs-utils	Nessus	SuSE Local Security Checks	critical
12405	RHEL 2.1 : nfs-utils (RHSA-2003:207)	Nessus	Red Hat Local Security Checks	critical
11800	Linux NFS utils package (nfs-utils) mountd xlog Function Off-by-one Remote Overflow	Nessus	RPC	critical

Detections

Analytics

CVE-2003-0252

critical

Tenable Plugins

critical

critical

critical

critical

critical