New nfs-utils packages are available for Slackware 8.1, 9.0, and -current
to fix an off-by-one buffer overflow in xlog.c. Thanks to Janusz
Niewiadomski for discovering and reporting this problem.
The CVE (Common Vulnerabilities and Exposures) Project has assigned the
identification number CAN-2003-0252 to this issue.
Here are the details from the Slackware 9.0 ChangeLog:
iMon Jul 14 14:15:34 PDT 2003
patches/packages/nfs-utils-1.0.4-i386-1.tgz: Upgraded to nfs-utils-1.0.4.
This fixes an off-by-one buffer overflow in xlog.c which could be used
by an attacker to produce a denial of NFS service, or to execute
arbitrary code. All sites providing NFS services should upgrade to
this new package immediately.
(* Security fix *)
WHERE TO FIND THE NEW PACKAGES:
Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/nfs-utils-1.0.4-i386-1.tgz
Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/nfs-utils-1.0.4-i386-1.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/nfs-utils-1.0.4-i486-1.tgz
MD5 SIGNATURES:
Slackware 8.1 package:
e6853189637bab81e7ba145ba3a401ae nfs-utils-1.0.4-i386-1.tgz
Slackware 9.0 package:
92d45eeb49bade596c78c42b72af8807 nfs-utils-1.0.4-i386-1.tgz
Slackware -current package:
78ab9c34e3e01243626697d028a3ade2 nfs-utils-1.0.4-i486-1.tgz
INSTALLATION INSTRUCTIONS:
First, if the NFS server is running, stop it:
. /etc/rc.d/rc.nfsd stop
Then upgrade using upgradepkg (as root):
upgradepkg nfs-utils-1.0.4-i386-1.tgz
Finally, restart NFS services:
. /etc/rc.d/rc.nfsd start
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Slackware | 8.1 | i386 | nfs-utils | < 1.0.4 | nfs-utils-1.0.4-i386-1.tgz |
Slackware | 9.0 | i386 | nfs-utils | < 1.0.4 | nfs-utils-1.0.4-i386-1.tgz |