nfs-utils-1.2.3-15.AXS4

エラータID: AXSA:2012-04:01

Release date: 
Wednesday, January 4, 2012 - 13:46
Subject: 
nfs-utils-1.2.3-15.AXS4
Affected Channels: 
Asianux Server 4 for x86
Asianux Server 4 for x86_64
Severity: 
High
Description: 

The nfs-utils package provides a daemon for the kernel NFS server and related tools, which provides a much higher level of performance than the traditional Linux NFS server used by most users.
This package also contains the showmount program. Showmount queries the mount daemon on a remote host for information about the NFS (Network File System) server on the remote host. For example, showmount can display the clients which are mounted on that host.
This package also contains the mount.nfs and umount.nfs program.
Security issues fixed with this release:
CVE-2011-1749
CVE-2011-2500
No information available at the time of writing, see the CVE link below.
Fixed bugs:
- Single quote characters in the path name of a mount point entry were not parsed properly: if the mount point contained a single quote character, an NFS exported file system could not be unmounted. The parsing routines have been rewritten to fix this.

Solution: 

Update packages.

CVEs: 
CVE-2011-1749
The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.
CVE-2011-2500
The host_reliable_addrinfo function in support/export/hostname.c in nfs-utils before 1.2.4 does not properly use DNS to verify access to NFS exports, which allows remote attackers to mount filesystems by establishing crafted DNS A and PTR records.
Additional Info: 

N/A

Download: 

SRPMS
  1. nfs-utils-1.2.3-15.AXS4.src.rpm
    MD5: 838b4fed05c1800ee3fde10176cb3914
    SHA-256: 9f866f77d3c3bb70b2b79e883989f180feebabce8b5138b721b04ae17a8cb986
    Size: 754.81 kB

Asianux Server 4 for x86
  1. nfs-utils-1.2.3-15.AXS4.i686.rpm
    MD5: 26c8c56af0c35f2cf70a8d63d0200b82
    SHA-256: d5cce51df4daf18733b9daa8bf1ab3b1d40cdda03348a3d056c7ec7be9dbd3f8
    Size: 305.63 kB

Asianux Server 4 for x86_64
  1. nfs-utils-1.2.3-15.AXS4.x86_64.rpm
    MD5: b7c43637a4b5c1a7494c76a26f9fc10b
    SHA-256: 796455fa938588aad6f7424c2be3da8275d6ea4e7894dff9c8a11f36daf9ef8f
    Size: 307.40 kB