-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] nfs-utils off-by-one overflow fixed (SSA:2003-195-01)
New nfs-utils packages are available for Slackware 8.1, 9.0, and -current to fix an off-by-one buffer overflow in xlog.c. Thanks to Janusz Niewiadomski for discovering and reporting this problem. The CVE (Common Vulnerabilities and Exposures) Project has assigned the identification number CAN-2003-0252 to this issue. Here are the details from the Slackware 9.0 ChangeLog: +--------------------------+ iMon Jul 14 14:15:34 PDT 2003 patches/packages/nfs-utils-1.0.4-i386-1.tgz: Upgraded to nfs-utils-1.0.4. This fixes an off-by-one buffer overflow in xlog.c which could be used by an attacker to produce a denial of NFS service, or to execute arbitrary code. All sites providing NFS services should upgrade to this new package immediately. (* Security fix *) +--------------------------+ WHERE TO FIND THE NEW PACKAGES: +-----------------------------+ Updated package for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/nfs-utils-1.0.4-i386-1.tgz Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/nfs-utils-1.0.4-i386-1.tgz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/nfs-utils-1.0.4-i486-1.tgz MD5 SIGNATURES: +-------------+ Slackware 8.1 package: e6853189637bab81e7ba145ba3a401ae nfs-utils-1.0.4-i386-1.tgz Slackware 9.0 package: 92d45eeb49bade596c78c42b72af8807 nfs-utils-1.0.4-i386-1.tgz Slackware -current package: 78ab9c34e3e01243626697d028a3ade2 nfs-utils-1.0.4-i486-1.tgz INSTALLATION INSTRUCTIONS: +------------------------+ First, if the NFS server is running, stop it: . /etc/rc.d/rc.nfsd stop Then upgrade using upgradepkg (as root): upgradepkg nfs-utils-1.0.4-i386-1.tgz Finally, restart NFS services: . /etc/rc.d/rc.nfsd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key [EMAIL PROTECTED] +------------------------------------------------------------------------+ | HOW TO REMOVE YOURSELF FROM THIS MAILING LIST: | +------------------------------------------------------------------------+ | Send an email to [EMAIL PROTECTED] with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back. Follow the instructions to | | complete the unsubscription. Do not reply to this message to | | unsubscribe! | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE/E1S/akRjwEAQIjMRAqFgAJ0ek3pomwl/6AAQk5EI0weHtB7IUgCdHdD5 5Y0dzEJmquqH2zQpcCJnZAU= =/f8X -----END PGP SIGNATURE----- _______________________________________________ slack-users mailing list [EMAIL PROTECTED] http://www.linuxmag.com.br/mailman/listinfo/slack-users
