PT-2003-2525 · Linux · Nfs-Utils

Janusz Niewiadomski · Published 1970-01-01 · Updated 2024-02-02 · CVE-2003-0252

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nfs-utils versions prior to 1.0.4

Description The issue is caused by an off-by-one error in the xlog function of mountd in the Linux NFS utils package. This error allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines. The vulnerability can be exploited remotely, potentially leading to a disruption of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the mountd service to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

BDU:2015-02020

BDU:2015-02021

BDU:2015-04794

BDU:2015-08173

CVE-2003-0252

DSA-349

Affected Products

Nfs-Utils

References · 32

• 🔥 http://marc.info/?l=bugtraq&m=105820223707191&w=2 · Exploit
• 🔥 http://isec.pl/vulnerabilities/isec-0010-linux-nfs-utils.txt · Exploit
• http://mandriva.com/security/advisories?name=MDKSA-2003:076 · Vendor Advisory
• http://debian.org/security/2003/dsa-349 · Vendor Advisory
• http://turbolinux.com/security/TLSA-2003-44.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02020 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0252 · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0024.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2003_031_nfs_utils.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04794 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001262.1-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02021 · Security Note
• https://bdu.fstec.ru/vul/2015-08173 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0252 · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0023.html · Vendor Advisory