SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Rpc.statd Vendors:   [Multiple Authors/Vendors]
(Debian Issues Fix) rpc.statd SIGPIPE Error Lets Remote Users Shutdown the Process
SecurityTracker Alert ID:  1012456
SecurityTracker URL:  http://securitytracker.com/id/1012456
CVE Reference:   CVE-2004-1014   (Links to External Site)
Date:  Dec 8 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in 'rpc.statd'. A remote user can cause denial of service conditions.

Several vendors reported a vulnerability in the NFS statd server. The rpc.statd process does not ignore the SIGPIPE signal. As a result, a remote process can prematurely terminate the TCP connection to trigger the signal and cause the process to shutdown.

SGI developers are credited with discovering this flaw.

Impact:   A remote user can cause 'rpc.statd' to shutdown.
Solution:   Debian has released a fix for the stable distribution (woody) in version 1.0-2woody2.

Debian GNU/Linux 3.0 alias woody:

Source archives:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody3.dsc
Size/MD5 checksum: 547 3130d22c0276d04624c6f2d1a11c8303
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody3.tar.gz
Size/MD5 checksum: 241106 1ad532739493eb1e75a8398b34d1ad7d

Alpha architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_alpha.deb
Size/MD5 checksum: 52842 015c232faf3cee96a5c3a54678c59977
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_alpha.deb
Size/MD5 checksum: 79518 b4f4190c36fef9a93a2082bffd0e4d84
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_alpha.deb
Size/MD5 checksum: 36782 6dd2f841d3e11784d2c8d1b4bd07dfd3

ARM architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_arm.deb
Size/MD5 checksum: 44942 6c5f08da6424e097c8f1d8d4707f438f
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_arm.deb
Size/MD5 checksum: 67632 8de496b9ec85c6c7701936d53c54d8c4
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_arm.deb
Size/MD5 checksum: 34466 d76dba5e7e3959106a5ae61546d10ca0

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_i386.deb
Size/MD5 checksum: 44522 7f7420ee316712a6c8fdb84ad38c3423
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_i386.deb
Size/MD5 checksum: 66702 101b0a737c55fd410b004183e7d40cd5
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_i386.deb
Size/MD5 checksum: 33584 e52f4cec67c9857cc495271bc3b41b66

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_ia64.deb
Size/MD5 checksum: 59118 9fe256ee1e7df20f0e9fb1b7e703c39d
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_ia64.deb
Size/MD5 checksum: 93468 659c7cca40d3af68caa1763e09346518
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_ia64.deb
Size/MD5 checksum: 41600 07dfa5bccb3398586771c3ad59cdfdda

HP Precision architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_hppa.deb
Size/MD5 checksum: 50050 8e4f64ec9e32a6cb911ebe80ee3b3a8f
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_hppa.deb
Size/MD5 checksum: 75046 a5ad5228b08feb37f8cdf2550b45af01
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_hppa.deb
Size/MD5 checksum: 36878 5f4742217e7755bab6a004995c0722f3

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_m68k.deb
Size/MD5 checksum: 43686 90559b02e9b9984d971355068fbc2d6c
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_m68k.deb
Size/MD5 checksum: 64354 0ac16c01b567116927527f21552c187a
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_m68k.deb
Size/MD5 checksum: 33302 d7e808ebf28a8825ee7e208dac71328c

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_mips.deb
Size/MD5 checksum: 47664 69f1a8ba05ecb0464d4c7ed2e61e9532
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_mips.deb
Size/MD5 checksum: 74858 f7ca8e3b86290eb46c607b7148fcc5a0
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_mips.deb
Size/MD5 checksum: 35798 9735fe0cca23043317622a5cf3bc29cd

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_mipsel.deb
Size/MD5 checksum: 47830 9de4abc7f659345aff33d2dd4a4b344f
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_mipsel.deb
Size/MD5 checksum: 74918 2d20c2421b7108b767dcc500da0735a0
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_mipsel.deb
Size/MD5 checksum: 35730 efde5bc0a8395d54ad5bfe7f41a3a4a4

PowerPC architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_powerpc.deb
Size/MD5 checksum: 45964 1169d5e000ce060eb93814eac3a37f4f
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_powerpc.deb
Size/MD5 checksum: 69066 81a6c1defb8c99555bbe6e4448175be4
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_powerpc.deb
Size/MD5 checksum: 34536 23638627fbed5fa65351906c21da83ba

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_s390.deb
Size/MD5 checksum: 46148 b9f22c5ba045f822f7c32e63266c939c
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_s390.deb
Size/MD5 checksum: 70118 19bf493ac9b9481dc9aa39b670c73ed2
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_s390.deb
Size/MD5 checksum: 34662 7b2570d55a49a79cc54d4b613d38ef94

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_sparc.deb
Size/MD5 checksum: 52116 a44018d8bfd17f534fc53f83fd8cafd0
http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_sparc.deb
Size/MD5 checksum: 76376 89f60dd027bf843aace78e0ddfe22ec3
http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_sparc.deb
Size/MD5 checksum: 37054 490c89a13f6f68715f619069f5a7a5ce

Vendor URL:  www.debian.org/security/ (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Debian)
Underlying OS Comments:  3.0

Message History:   This archive entry is a follow-up to the message listed below.
Dec 7 2004 rpc.statd SIGPIPE Error Lets Remote Users Shutdown the Process



 Source Message Contents

Subject:  [SECURITY] [DSA 606-1] New nfs-utils packages fix denial of service


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 606-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
December 8th, 2004                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : nfs-utils
Vulnerability  : wrong signal handler
Problem-Type   : remote
Debian-specific: no
CVE ID         : CAN-2004-1014

SGI has discovered that rpc.statd from the nfs-utils package, the
Network Status Monitor, did not ignore the "SIGPIPE".  Hence, a client
prematurely terminating the TCP connection could also terminate the
server process.

For the stable distribution (woody) this problem has been fixed in
version 1.0-2woody2.

For the unstable distribution (sid) this problem will be fixed soon.

We recommend that you upgrade your nfs-utils package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody3.dsc
      Size/MD5 checksum:      547 3130d22c0276d04624c6f2d1a11c8303
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-utils_1.0-2woody3.tar.gz
      Size/MD5 checksum:   241106 1ad532739493eb1e75a8398b34d1ad7d

  Alpha architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_alpha.deb
      Size/MD5 checksum:    52842 015c232faf3cee96a5c3a54678c59977
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_alpha.deb
      Size/MD5 checksum:    79518 b4f4190c36fef9a93a2082bffd0e4d84
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_alpha.deb
      Size/MD5 checksum:    36782 6dd2f841d3e11784d2c8d1b4bd07dfd3

  ARM architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_arm.deb
      Size/MD5 checksum:    44942 6c5f08da6424e097c8f1d8d4707f438f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_arm.deb
      Size/MD5 checksum:    67632 8de496b9ec85c6c7701936d53c54d8c4
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_arm.deb
      Size/MD5 checksum:    34466 d76dba5e7e3959106a5ae61546d10ca0

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_i386.deb
      Size/MD5 checksum:    44522 7f7420ee316712a6c8fdb84ad38c3423
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_i386.deb
      Size/MD5 checksum:    66702 101b0a737c55fd410b004183e7d40cd5
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_i386.deb
      Size/MD5 checksum:    33584 e52f4cec67c9857cc495271bc3b41b66

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_ia64.deb
      Size/MD5 checksum:    59118 9fe256ee1e7df20f0e9fb1b7e703c39d
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_ia64.deb
      Size/MD5 checksum:    93468 659c7cca40d3af68caa1763e09346518
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_ia64.deb
      Size/MD5 checksum:    41600 07dfa5bccb3398586771c3ad59cdfdda

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_hppa.deb
      Size/MD5 checksum:    50050 8e4f64ec9e32a6cb911ebe80ee3b3a8f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_hppa.deb
      Size/MD5 checksum:    75046 a5ad5228b08feb37f8cdf2550b45af01
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_hppa.deb
      Size/MD5 checksum:    36878 5f4742217e7755bab6a004995c0722f3

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_m68k.deb
      Size/MD5 checksum:    43686 90559b02e9b9984d971355068fbc2d6c
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_m68k.deb
      Size/MD5 checksum:    64354 0ac16c01b567116927527f21552c187a
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_m68k.deb
      Size/MD5 checksum:    33302 d7e808ebf28a8825ee7e208dac71328c

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_mips.deb
      Size/MD5 checksum:    47664 69f1a8ba05ecb0464d4c7ed2e61e9532
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_mips.deb
      Size/MD5 checksum:    74858 f7ca8e3b86290eb46c607b7148fcc5a0
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_mips.deb
      Size/MD5 checksum:    35798 9735fe0cca23043317622a5cf3bc29cd

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_mipsel.deb
      Size/MD5 checksum:    47830 9de4abc7f659345aff33d2dd4a4b344f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_mipsel.deb
      Size/MD5 checksum:    74918 2d20c2421b7108b767dcc500da0735a0
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_mipsel.deb
      Size/MD5 checksum:    35730 efde5bc0a8395d54ad5bfe7f41a3a4a4

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_powerpc.deb
      Size/MD5 checksum:    45964 1169d5e000ce060eb93814eac3a37f4f
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_powerpc.deb
      Size/MD5 checksum:    69066 81a6c1defb8c99555bbe6e4448175be4
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_powerpc.deb
      Size/MD5 checksum:    34536 23638627fbed5fa65351906c21da83ba

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_s390.deb
      Size/MD5 checksum:    46148 b9f22c5ba045f822f7c32e63266c939c
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_s390.deb
      Size/MD5 checksum:    70118 19bf493ac9b9481dc9aa39b670c73ed2
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_s390.deb
      Size/MD5 checksum:    34662 7b2570d55a49a79cc54d4b613d38ef94

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-common_1.0-2woody3_sparc.deb
      Size/MD5 checksum:    52116 a44018d8bfd17f534fc53f83fd8cafd0
    http://security.debian.org/pool/updates/main/n/nfs-utils/nfs-kernel-server_1.0-2woody3_sparc.deb
      Size/MD5 checksum:    76376 89f60dd027bf843aace78e0ddfe22ec3
    http://security.debian.org/pool/updates/main/n/nfs-utils/nhfsstone_1.0-2woody3_sparc.deb
      Size/MD5 checksum:    37054 490c89a13f6f68715f619069f5a7a5ce


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFBtrNAW5ql+IAeqTIRAtcgAJ9Ih8putjIZVxU+J8wdovQ6gy3FMQCeINTY
rLEeCjeeMbBqoHP98IbgQOg=
=bcmJ
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC