TITLE: nfs-server "rpc.mountd" Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA18614 VERIFY ADVISORY: http://secunia.com/advisories/18614/ CRITICAL: Moderately critical IMPACT: System access WHERE: >From local network SOFTWARE: nfs-server 2.x http://secunia.com/product/7057/ DESCRIPTION: A vulnerability has been reported in nfs-server, which can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to a boundary error in the "realpath()" function used by rpc.mountd. This can be exploit to cause a buffer overflow when processing mount requests. Successful exploitation allows arbitrary code execution with root privileges but requires the ability to create symlinks on any of the file systems on the machine running rpc.mountd. The vulnerability may also be exploitable by users without filesystem access. SOLUTION: Restrict access to trusted users only. Some Linux vendors have issued updated packages. PROVIDED AND/OR DISCOVERED BY: Reported in a SUSE advisory. ORIGINAL ADVISORY: http://lists.suse.com/archive/suse-security-announce/2006-Jan/0007.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------