Bug 42744 (CVE-2003-0252)

Date: Sun, 6 Jul 2003 15:32:55 +0200 (CEST) 
From: Janusz Niewiadomski <funkysh@isec.pl> 
To: vendor-sec@lst.de 
Subject: [vendor-sec] Linux nfs-utils xlog() off-by-one bug 
 
-----BEGIN PGP SIGNED MESSAGE----- 
Hash: SHA1 
 
 
Hi, 
 
Some of you may be already informed about nfs-utils vulnerability 
that we are going to disclose in near future. For the rest, below 
is attached copy of advisory. Since a fix is already available we 
(isec and nfs-utils vendors) decided to release advisory and new 
(1.4.0) version of package at July 14th, 12.00 EST. The question 
is, is that date acceptable for you? Suggestions would be appreciated. 
Also please contact Neil Brown <neilb@cse.unsw.edu.au> for any 
information regarding fix / new version of nfs-utils. 
 
Regards, 
 
- --8<-- 
 
 
Synopsis:       Linux nfs-utils xlog() off-by-one bug 
Product:        nfs-utils 
Version:        <= 1.0.3 
Vendor:         http://sourceforge.net/projects/nfs/ 
 
URL:            http://isec.pl/vulnerabilities/ 
CVE:            CAN-2003-0252 
Author:         Janusz Niewiadomski <funkysh@isec.pl> 
Date:           July 14, 2003 
 
 
Issue: 
====== 
 
Linux NFS utils package contains remotely exploitable off-by-one bug. 
A local or remote attacker could exploit this vulnerability by sending 
specially crafted request to rpc.mountd daemon. 
 
Details: 
======== 
 
An off-by-one bug exist in xlog() function which handles logging of 
requests. An overflow occurs when function is trying to add missing 
trailing newline character to logged string. 
 
Due to miscalculation, if a string passed to the functions is equal 
or longer than 1023 bytes, the '\0' byte will be written beyond the 
buffer: 
 
 
- ------8<------cut-here------8<------ 
 
        char            buff[1024]; 
        ... 
 
        va_start(args, fmt); 
        vsnprintf(buff, sizeof (buff), fmt, args); 
        va_end(args); 
        buff[sizeof (buff) - 1] = 0; 
 
        if ((n = strlen(buff)) > 0 && buff[n-1] != '\n') { 
                buff[n++] = '\n'; buff[n++] = '\0'; 
        } 
 
- ------8<------cut-here------8<------ 
 
 
Impact: 
======= 
 
Local or remote attacker which is capable to send RPC request to 
vulnerable mountd daemon could execute artitrary code or cause 
denial of service. 
 
 
Vendor Status: 
============== 
 
June 10, 2003    Vendor has been contacted 
 
- -- 
Janusz Niewiadomski 
iSEC Security Research 
http://isec.pl/ 
 
-----BEGIN PGP SIGNATURE----- 
Version: GnuPG v1.0.7 (GNU/Linux) 
 
iD8DBQE/CCUVzGsegB5eZ9IRAnKFAJ9xpByOopFUOXf6S1i5hdq0+cfBxACglG78 
le515PamUwSTLvcADtOnycQ= 
=iP4z 
-----END PGP SIGNATURE----- 
 
 
_______________________________________________ 
Vendor Security mailing list 
Vendor Security@lst.de 
http://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec