Linux NFS utils package "rpc.mountd" contains off-by-one buffer overflow in xlog() function

Overview

A vulnerability in the Linux NFS (network File System) could permit an attacker to cause a denial of service, or potentially execute arbitrary code on the system.

Description

The Linux NFS (network File System) was developed to allow machines to mount a disk partition on a remote machine as if it were on a local hard drive.** **An off-by-one overflow exist in the xlog() function which handles logging of requests. Any attacker that is able to send RPC requests to vulnerable mountd daemon could exploit this vulnerability.

An exploit for this vulnerability has been reported in the wild.

---

Impact

A remote attacker may be able to cause a denial of service, or potentially execute arbitrary code on the system.

---

Solution

Version 1.0.4 has been released to address this issue.

---

Vendor Information

258564

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Linux NFS Affected

Updated: September 17, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258564 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://nfs.sourceforge.net/&gt;
• <http://sourceforge.net/projects/nfs/&gt;
• <http://www.secunia.com/advisories/9259/&gt;
• <http://xforce.iss.net/xforce/xfdb/12600&gt;
• <http://securitytracker.com/alerts/2003/Jul/1007187.html&gt;
• <http://www.securityfocus.com/bid/8179&gt;

Acknowledgements

Thanks to Janusz Niewiadomski for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

CVE IDs:	CVE-2003-0252
Severity Metric:	13.39 Date Public: