[SECURITY] New version of nfs-server fixes remote exploit

The version of nfs-server that was distributed in Debian GNU/Linux 2.1 had a buffer overflow in fhbuildpath. It assumed that the total length of a path would never exceed PATHMAXNAMEMAX. With a read/write exported directory people could created longes path and cause a bufferoverflow. This has bee...

[SECURITY] New version of nfs-server fixes remote exploit

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 11, 1999 - ------------------------------------------------------------------------ The version of nfs-server that was...

CVE-1999-0832

Buffer overflow in NFS server on Linux allows attackers to execute commands via a long pathname...

CVE-1999-1349

NFS daemon nfsd.exe for Omni-NFS/X 6.1 allows remote attackers to cause a denial of service resource exhaustion via certain packets, possibly with the Urgent URG flag set, to port 111...

Omni-NFS_DoS.txt

Faulty software --------------- Omni-NFS/X Enterprise version 6.1 Product --------- Omni-NFS/X Enterprise is a X, NFS server solution for win32 systems. It is written by XLink Technology http://www.xlink.com . Vulnerability ------------- The nfs daemon nfsd.exe used by Omni-NFS/X will jump to 100...

CVE-1999-0084

Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0...

CVE-1999-0084

CVE-1999-0084 affects certain NFS servers . The vulnerability permits a local user to perform a privileged action by running mknod to create a writable kmem device and set the UID to 0, effectively enabling a privilege escalation to root as described in the provided sources. Multiple connected do...

CVE-1999-0170

Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list...

CVE-1999-0166

NFS allows users to use a "cd .." command to access other directories besides the exported file system...

CVE-1999-0166

The CVE-1999-0166 issue concerns NFS where a client can issue a "cd .." to escape the exported tree and access other directories beyond the intended NFS export. The connected sources describe it as an information-disclosure risk, potentially enabling an attacker to read files outside the exported...

CVE-1999-0170

CVE-1999-0170 describes a vulnerability where remote attackers can mount an NFS file system on Ultrix or OSF even when access is denied by the access control list. Connected sources corroborate Ultrix/OSF as affected and reference NFS mounting behavior as the underlying issue. The NVD entry rates...

CVE-1999-0168

The portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, possibly bypassing authentication that would otherwise have taken place. For example, NFS file systems could be mounted through the portmapper despite export...

CVE-1999-0084

Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0...

CVE-1999-0167

CVE-1999-0167 describes a vulnerability in SunOS where NFS file handles are predictable/guessable, allowing an attacker to mount exported file systems without proper authorization. The issue arises from guessable NFS file handles as the root cause, with potential exposure of confidentiality, inte...

CVE-1999-0002

Buffer overflow in NFS mountd gives root access to remote attackers, mostly in Linux systems...

CVE-1999-0167

In SunOS, NFS file handles could be guessed, giving unauthorized access to the exported file system...

CVE-1999-0002

CVE-1999-0002 is a buffer overflow in the NFS mountd service that can give remote root access on Linux-like systems. The core description across sources confirms a remote-executable overflow in mountd, potentially enabling privilege elevation without an account. Public references describe related...

CVE-1999-0211

Extra long export lists over 256 characters in some mount daemons allows NFS directories to be mounted by anyone...

CVE-1999-0211

CVE-1999-0211 is tied to NFS export handling where extra long export lists (over 256 characters) in mount daemons enable unauthenticated mounting of NFS directories. Public sources (Red Hat security page, CVE lists, Nessus plugin) describe that an attacker could mount exported shares, with Nessus...

FreeBSD_DoS.txt

Resending once, since it's been 10.5 days... Here's an interesting denial-of-service attack against FreeBSD =3.0 systems. It abuses a flaw in the new' FreeBSD vfscache.c; it has no way to purge entries unless the vnode' e.g. the file they point to is removed from memory -- which generally doesn't...