远程 Sun rpc.cmsd 的 xdr_array 中存在整数溢出问题。攻击者可能会利用此缺陷，通过向此服务发送特别构建的请求，以运行 rpc.cmsd 的特权（通常为根特权）在此主机上执行任意代码。

A heap buffer overflow exists in the XDR decoder in glibc version 2.2.5 and earlier. XDR is a mechanism for encoding data structures for use with RPC, which is derived from Sun's RPC implementation which is likewise vulnerable to a heap overflow. Depending on the application, this vulnerability may be exploitable and could lead to arbitrary code execution. Thanks to Solar Designer for the patches used to correct this vulnerability.

An integer overflow bug has been discovered in the RPC library used by the OpenAFS database server, which is derived from the SunRPC library.
This bug could be exploited to crash certain OpenAFS servers (volserver, vlserver, ptserver, buserver) or to obtain unauthorized root access to a host running one of these processes. No exploits are known to exist yet.

Updated glibc packages are available which fix a buffer overflow in the XDR decoder and two vulnerabilities in the resolver functions.

[updated 8 aug 2002] Updated packages have been made available, as the original errata introduced a bug which could cause calloc() to crash on 32-bit platforms when passed a size of 0. These updated errata packages contain a patch to correct this bug.

The glibc package contains standard libraries which are used by multiple programs on the system. Sun RPC is a remote procedure call framework which allows clients to invoke procedures in a server process over a network. XDR is a mechanism for encoding data structures for use with RPC. NFS, NIS, and other network services that are built upon Sun RPC. The glibc package contains an XDR encoder/decoder derived from Sun's RPC implementation which was recently demonstrated to be vulnerable to a heap overflow.

An error in the calculation of memory needed for unpacking arrays in the XDR decoder can result in a heap buffer overflow in glibc 2.2.5 and earlier. Depending upon the application, this vulnerability may be exploitable and could lead to arbitrary code execution.
(CVE-2002-0391)

A buffer overflow vulnerability has been found in the way the glibc resolver handles the resolution of network names and addresses via DNS (as per Internet RFC 1011). Version 2.2.5 of glibc and earlier versions are affected. A system would be vulnerable to this issue if the 'networks' database in the /etc/nsswitch.conf file includes the 'dns' entry. By default, Red Hat Linux Advanced Server ships with 'networks' set to 'files' and is therefore not vulnerable to this issue. (CVE-2002-0684)

A related issue is a bug in the glibc-compat packages, which provide compatibility for applications compiled against glibc version 2.0.x.
Applications compiled against this version (such as those distributed with early Red Hat Linux releases 5.0, 5.1, and 5.2) could also be vulnerable to this issue. (CVE-2002-0651)

All users should upgrade to these errata packages which contain patches to the glibc libraries and therefore are not vulnerable to these issues.

Thanks to Solar Designer for providing patches for this issue.

The network authentication system in Kerberos 5 contains an RPC library that includes an XDR decoder derived from Sun's RPC implementation. This implemenation is vulnerable to a heap overflow.
With Kerberos, it is believed that an attacker would need to be able to successfully authenticate to kadmin to be able to exploit this vulnerability.

The remote host is missing the patch for the advisory SUSE-SA:2002:031 (glibc).


An integer overflow has been discovered in the xdr_array() function, contained in the Sun Microsystems RPC/XDR library, which is part of the glibc library package on all SUSE products. This overflow allows a remote attacker to overflow a buffer, leading to remote execution of arbitrary code supplied by the attacker.

There is no temporary workaround for this security problem other than disabling all RPC based server and client programs. The permanent solution is to update the glibc packages with the update packages listed below.

An integer overflow bug has been discovered in the RPC library used by dietlibc, a libc optimized for small size, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the calloc, fread and fwrite code. They are also more strict regarding hostile DNS packets that could lead to a vulnerability otherwise.

These problems have been fixed in version 0.12-2.4 for the current stable distribution (woody) and in version 0.20-0cvs20020808 for the unstable distribution (sid). Debian 2.2 (potato) is not affected since it doesn't contain dietlibc packages.

The remote Sun rpc.cmsd has integer overflow problem in xdr_array. An attacker may use this flaw to execute arbitrary code on this host with the privileges rpc.cmsd is running as (typically, root), by sending a specially crafted request to this service.

Updated Kerberos 5 packages are now available for Red Hat LInux Advanced Server. These updates fix a buffer overflow in the XDR decoder.

Sun RPC is a remote procedure call framework which allows clients to invoke procedures in a server process over a network. XDR is a mechanism for encoding data structures for use with RPC.

The Kerberos 5 network authentication system contains an RPC library which includes an XDR decoder derived from Sun's RPC implementation.
The Sun implementation was recently demonstrated to be vulnerable to a heap overflow. It is believed that the attacker needs to be able to authenticate to the kadmin daemon for this attack to be successful. No exploits are known to currently exist.

All users should upgrade to these errata packages which contain an updated version of Kerberos 5 which is not vulnerable to this issue.

An integer overflow bug has been discovered in the RPC library used by the Kerberos 5 administration system, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to a KDC host. It is believed that the attacker needs to be able to authenticate to the kadmin daemon for this attack to be successful. No exploits are known to exist yet.

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also contain a fix from Andreas Schwab to reduce linebuflen in parallel to bumping up the buffer pointer in the NSS DNS code.

acm, a multi-player aerial combat simulation, uses a network protocol based on the same RPC implementation used in many C libraries. This implementation was found to contain an integer overflow vulnerability which could be exploited to execute arbitrary code.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
11418	Sun rpc.cmsd 远程溢出	Nessus	RPC	2003/3/19	2018/8/22	critical
13962	Mandrake Linux Security Advisory : glibc (MDKSA-2002:061)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	critical
14979	Debian DSA-142-1 : openafs - integer overflow	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
12318	RHEL 2.1 : glibc (RHSA-2002:167)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	critical
13958	Mandrake Linux Security Advisory : krb5 (MDKSA-2002:057)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	critical
13753	SUSE-SA:2002:031: glibc	Nessus	SuSE Local Security Checks	2004/7/25	2021/1/14	critical
14983	Debian DSA-146-2 : dietlibc - integer overflow	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
11418	Sun rpc.cmsd Remote Overflow	Nessus	RPC	2003/3/19	2018/8/22	critical
12320	RHEL 2.1 : krb5 (RHSA-2002:173)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	critical
14980	Debian DSA-143-1 : krb5 - integer overflow	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
14986	Debian DSA-149-1 : glibc - integer overflow	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
15170	Debian DSA-333-1 : acm - integer overflow	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical