[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

CERT Advisory CA-98.12: Exploitable Buffer Overflow in mountd?

I just got the following message from my local network administrator.
I visited the URL and found a pointer to a patch for Red Hat systems,
but found no mention of what to do about a Debian system.

I am running an up-to-date Debian slink system.

Does anybody know about this?  I hope it's not a FAQ.

----- Forwarded message from Andy Feldt <feldt@mail.nhn.ou.edu> -----

Date: Tue, 27 Oct 1998 14:18:43 -0600
From: feldt@mail.nhn.ou.edu (Andy Feldt)
To: linuxusers@mail.nhn.ou.edu
Subject: security bug!

Linux users:

You should take action on this as soon as possible:


Some request logging implementations of NFS servers exhibit a vulnerability.
The vulnerability lies in the software on the NFS server that handles 
requests to mount file systems.  This program is usually named "mountd" 
or "rpc.mountd". Malicious users who exploit the vulnerability are able 
to gain root access to the vulnerable NFS file server. This vulnerability 
can be exploited remotely and does not require an account on the target 
machine.  For further information can be found at:


----- End forwarded message -----

Thomas E. Vaughan                            vaughan@mail.nhn.ou.edu
Dept. of Physics & Astronomy                 home: (405) 366-8721
University of Oklahoma, Norman               work: (405) 325-3961x36403

Reply to: