Bug 42541 (CVE-2003-0251)

Summary: VUL-0: CVE-2003-0251: ypserv: denial-of-service attack in ypserv
Product: [Novell Products] SUSE Security Incidents Reporter: Thomas Biege <thomas>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: security-team
Version: unspecified   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: CVE-2003-0251: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Thomas Biege 2003-06-26 15:16:45 UTC 
Hi, 
this might be interessting for you. 
http://www.securityfocus.com/archive/1/326735 
The CAN is reserved but not details are published so far: 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0251 
 
If our systems are affected as well we need a security update for 
all maintained products + SL 7.2-8.2. 
I will attacj the p&p files in a few minutes.
Comment 1 Thomas Biege 2003-06-26 15:16:45 UTC 
<!-- SBZ_reproduce  -->
-
Comment 2 Thorsten Kukuk 2003-06-26 15:27:42 UTC 
You can start a denial-of-service attack on ypserv, as you can do with 
every RPC based service. That we fork for one function (from 12) does 
not prevent a user from creating such an attack with the help of another 
function. 
There are a lot of possibilities for such an attack, no of them is 
fixable. If RH uses the default limit, you need now 40 connections 
to stop the daemon. If you don't limit the number of connections, you 
can overflow the process table and eat all memory on the server. This 
would be even possible with a slow dialup connection and a very old i386 
PC, you don't need more resources than before (I have a nice multithreaded 
program for doing so). 
 
We plan to make a ypserv update estimated next week, but for other 
reasons (Fixing some errors in the protocol, where as result ypcat 
on Solaris could hang forever and possible corruption of the master 
name of a map on the slave side, nothing is fixed in RHs update).
Comment 3 Thomas Biege 2003-06-26 16:02:48 UTC 
Ok, I see. 
 
Time for closing this I think...
Comment 4 Thorsten Kukuk 2003-06-30 14:49:08 UTC 
Close it, a 2.9 update is on the way.
Comment 5 Thomas Biege 2009-10-13 19:35:59 UTC 
CVE-2003-0251: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)