Linux Today: Linux News On Internet Time.

More on LinuxToday

Slackware Linux Advisory: nfs-utils

Jul 15, 2003, 03:59 (3 Talkback[s])

WEBINAR: On-demand Event

Replace Oracle with the NoSQL Engagement Database: Why and how leading companies are making the switch REGISTER >

[slackware-security] nfs-utils off-by-one overflow fixed (SSA:2003-195-01)

New nfs-utils packages are available for Slackware 8.1, 9.0, and -current to fix an off-by-one buffer overflow in xlog.c. Thanks to Janusz Niewiadomski for discovering and reporting this problem.

The CVE (Common Vulnerabilities and Exposures) Project has assigned the identification number CAN-2003-0252 to this issue.

Here are the details from the Slackware 9.0 ChangeLog:
iMon Jul 14 14:15:34 PDT 2003
patches/packages/nfs-utils-1.0.4-i386-1.tgz: Upgraded to nfs-utils-1.0.4. This fixes an off-by-one buffer overflow in xlog.c which could be used by an attacker to produce a denial of NFS service, or to execute arbitrary code. All sites providing NFS services should upgrade to this new package immediately.
(* Security fix *)


Updated package for Slackware 8.1:

Updated package for Slackware 9.0:

Updated package for Slackware -current:


Slackware 8.1 package:
e6853189637bab81e7ba145ba3a401ae nfs-utils-1.0.4-i386-1.tgz

Slackware 9.0 package:
92d45eeb49bade596c78c42b72af8807 nfs-utils-1.0.4-i386-1.tgz

Slackware -current package:
78ab9c34e3e01243626697d028a3ade2 nfs-utils-1.0.4-i486-1.tgz


First, if the NFS server is running, stop it: . /etc/rc.d/rc.nfsd stop

Then upgrade using upgradepkg (as root): upgradepkg nfs-utils-1.0.4-i386-1.tgz

Finally, restart NFS services:
. /etc/rc.d/rc.nfsd start


Slackware Linux Security Team