[bglug] Fw: [slackware-security] nfs-utils off-by-one overflow fixed (SSA:2003-195-01)

[k|b|s]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Begin forwarded message:

Date: Mon, 14 Jul 2003 18:10:14 -0700 (PDT)
From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security]  nfs-utils off-by-one overflow fixed
(SSA:2003-195-01)



- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  nfs-utils off-by-one overflow fixed
(SSA:2003-195-01)

New nfs-utils packages are available for Slackware 8.1, 9.0, and
- -current
to fix an off-by-one buffer overflow in xlog.c.  Thanks to Janusz
Niewiadomski for discovering and reporting this problem.

The CVE (Common Vulnerabilities and Exposures) Project has assigned the
identification number CAN-2003-0252 to this issue.

Here are the details from the Slackware 9.0 ChangeLog:
+--------------------------+
iMon Jul 14 14:15:34 PDT 2003
patches/packages/nfs-utils-1.0.4-i386-1.tgz:  Upgraded to
nfs-utils-1.0.4.
  This fixes an off-by-one buffer overflow in xlog.c which could be used
  by an attacker to produce a denial of NFS service, or to execute
  arbitrary code.  All sites providing NFS services should upgrade to
  this new package immediately.
  (* Security fix *)
+--------------------------+


WHERE TO FIND THE NEW PACKAGES:
+-----------------------------+

Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/nfs-utils-1.0.4-i386-1.tgz

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/nfs-utils-1.0.4-i386-1.tgz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/nfs-utils-1.0.4-i486-1.tgz



MD5 SIGNATURES:
+-------------+

Slackware 8.1 package:
e6853189637bab81e7ba145ba3a401ae  nfs-utils-1.0.4-i386-1.tgz

Slackware 9.0 package:
92d45eeb49bade596c78c42b72af8807  nfs-utils-1.0.4-i386-1.tgz

Slackware -current package:
78ab9c34e3e01243626697d028a3ade2  nfs-utils-1.0.4-i486-1.tgz


INSTALLATION INSTRUCTIONS:
+------------------------+

First, if the NFS server is running, stop it:
. /etc/rc.d/rc.nfsd stop

Then upgrade using upgradepkg (as root):
upgradepkg nfs-utils-1.0.4-i386-1.tgz

Finally, restart NFS services:
. /etc/rc.d/rc.nfsd start



+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+----------------------------------------------------------------------
- --+
| HOW TO REMOVE YOURSELF FROM THIS MAILING LIST:                        
|
+----------------------------------------------------------------------
- --+
| Send an email to majordomo@slackware.com with this text in the body of
|
| the email message:                                                    
|
|                                                                       
|
|   unsubscribe slackware-security                                      
|
|                                                                       
|
| You will get a confirmation message back.  Follow the instructions to 
|
| complete the unsubscription.  Do not reply to this message to         
|
| unsubscribe!                                                          
|
+----------------------------------------------------------------------
- --+

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/E1S/akRjwEAQIjMRAqFgAJ0ek3pomwl/6AAQk5EI0weHtB7IUgCdHdD5
5Y0dzEJmquqH2zQpcCJnZAU=
=/f8X
- -----END PGP SIGNATURE-----


- -- 
http://www.polarhome.com/~kbs
mailto `echo moc.demmapsed@sbk|'rev'`

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (MingW32)

iEYEARECAAYFAj8TqGUACgkQPJE4D78UP9OYfwCfV/j/Bxldhr7NDyOeA40iYNYf
FcIAoJ4kPtrAEY4bZ5OlfZRS92jIu+fN
=N+He
-----END PGP SIGNATURE-----