[SECURITY] [DSA 975-1] New nfs-user-server packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 975-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 15th, 2006 http://www.debian.org/security/faq -...

CVE-2005-3623

nfs2acl.c in the Linux kernel 2.6.14.4 does not check for MAYSATTR privilege before setting access controls ACL on files on exported NFS filesystems, which allows remote attackers to bypass ACLs for readonly mounted NFS filesystems...

CVE-2005-3623

CVE-2005-3623 affects Linux kernel 2.6.14.4, where nfs2acl.c does not check MAY_SATTR before setting ACLs on files on exported NFS filesystems. This flaw can allow remote attackers to bypass ACLs on readonly-mounted NFS exports. The issue is addressed in kernel security updates (e.g., RHSA-2006:0...

Buffer overflow

Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks...

CVE-2006-0043

Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks...

CVE-2006-0043

Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks...

CVE-2006-0043

Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks...

CVE-2006-0043

CVE-2006-0043 concerns a buffer overflow in the nfs-user-server path handling that Debian advisories (DSA-975-1) describe as remote and capable of arbitrary code execution via symlinks. Debian notes vulnerable packages in older releases (woody/sarge lineage) and provides fixes in the 2.2beta47- p...

SUSE-SA:2006:005: nfs-server

The remote host is missing the patch for the advisory SUSE-SA:2006:005 nfs-server. An remotely exploitable problem exists in the rpc.mountd service in the user space NFS server package 'nfs-server'. Insufficient buffer space supplied to the realpath function when processing mount requests can lea...

nfs-server NFS rpc.mountd buffer overflow

realpath function buffer overflow. Kernel-level nfs-utils package is not vulnerable...

[Full-disclosure] SUSE Security Announcement: nfs-server/rpc.mountd remote code execution (SUSE-SA:2006:005)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUSE Security Announcement Package: nfs-server Announcement ID: SUSE-SA:2006:005 Date: Thu, 26 Jan 2006 14:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 Vulnerability Type: remote code execution Severity...

Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-95-1)

A remote Denial of Service vulnerability was discovered in the Netfilter IP packet handler. This allowed a remote attacker to crash the machine by sending specially crafted IP packet fragments. CAN-2005-0209 The Netfilter code also contained a memory leak. Certain locally generated packet fragmen...

Ubuntu 4.10 : nfs-utils vulnerability (USN-36-1)

SGI discovered a remote Denial of Service vulnerability in the NFS statd server. statd did not ignore the 'SIGPIPE' signal which caused it to shutdown if a misconfigured or malicious peer terminated the TCP connection prematurely. Note that Tenable Network Security has extracted the preceding...

rt-sa-2005-15.txt

Advisory: BSD Securelevels: Circumventing protection of files flagged immutable By mounting an arbitrary filesystem, it is possible to mask files flagged immutable with any user-defined files. Details ======= Product: FreeBSD up to 6.0-STABLE and 7.0-CURRENT OpenBSD up to 3.8 DragonFly up to 1.2...

[Full-disclosure] BSD Securelevels: Circumventing protection of files flagged immutable

Advisory: BSD Securelevels: Circumventing protection of files flagged immutable By mounting an arbitrary filesystem, it is possible to mask files flagged immutable with any user-defined files. Details ======= Product: FreeBSD up to 6.0-STABLE and 7.0-CURRENT OpenBSD up to 3.8 DragonFly up to 1.2...

CVE-2005-3623

nfs2acl.c in the Linux kernel 2.6.14.4 does not check for MAYSATTR privilege before setting access controls ACL on files on exported NFS filesystems, which allows remote attackers to bypass ACLs for readonly mounted NFS filesystems...

CVE-2005-3623

nfs2acl.c in the Linux kernel 2.6.14.4 does not check for MAYSATTR privilege before setting access controls ACL on files on exported NFS filesystems, which allows remote attackers to bypass ACLs for readonly mounted NFS filesystems...

CVE-2005-4798

Buffer overflow in NFS readlink handling in the Linux Kernel 2.4 up to 2.4.31 allows remote NFS servers to cause a denial of service crash via a long symlink, which is not properly handled in 1 nfs2xdr.c or 2 nfs3xdr.c and causes a crash in the NFS client...

QNX 4.25 suided dhcp.client binary

Hello all, I recently got a QNX 4.25 vmware image and i found that the dhcp.client shipped with it is suided. This obviously enables a normal user to control the NIC's configuration and produce some other attacks eg: if the system has some services which depend on 'host/ip based' authentication...

CVE-2005-0139

Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities...