From: Secunia Security Advisories (sec-advsecunia.com)
Date: Mon Jun 30 2003 - 04:36:55 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
ACM Network Protocol Integer Overflow Vulnerability

READ ONLINE:
http://www.secunia.com/advisories/9139/

CRITICAL:
Moderately critical

IMPACT:
DoS, System access

WHERE:
From local network

OPERATING SYSTEM:

Debian GNU/Linux unstable alias sid
Debian GNU/Linux 3.0

SOFTWARE:
ACM 5.x

DESCRIPTION:
Debian has reported a vulnerability in ACM, which potentially can be
exploited by malicious people to compromise a user's system.

ACM uses a network protocol based on an older version of SunRPC.
However, last year an integer overflow in the "xdr_array" function
was discovered in this version, which can be exploited to execute
arbitrary code on a vulnerable system.

SOLUTION:
Updated packages:

-- Debian GNU/Linux 3.0 alias woody --

Source archives:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1.dsc
Size/MD5 checksum: 593 7b97e94d274f4042c7092c677a399d1a
http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1.diff.gz
Size/MD5 checksum: 14248 42f110d62edb95c352bb068d97833057
http://security.debian.org/pool/updates/main/a/acm/acm_5.0.orig.tar.gz
Size/MD5 checksum: 1239047 c0768937733989eb4b10708a782eaf6a

Alpha architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_alpha.deb
Size/MD5 checksum: 583226 32bc02220b0e335d079854f1ff1fbb8b

ARM architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_arm.deb
Size/MD5 checksum: 544240 3b0947f07c5fc24b33ed7af591021e1f

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_i386.deb
Size/MD5 checksum: 525616 a3a6a0285fb698d2032a36ab87fd6a1f

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_ia64.deb
Size/MD5 checksum: 648708 2959fba6dccaa512dc831f2b150fe293

HP Precision architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_hppa.deb
Size/MD5 checksum: 570940 9e003ccf3112edd2c349086ac9e7b05a

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_m68k.deb
Size/MD5 checksum: 515596 b618564e2e94ca304372084dc58753cc

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_mips.deb
Size/MD5 checksum: 581384 af7e8c6e422f5ff0701baefe2e567891

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_mipsel.deb
Size/MD5 checksum: 581420 a711924b81bf95dd7d8c1577bfe90589

PowerPC architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_powerpc.deb
Size/MD5 checksum: 549898 36dd4c082f90af46f2252b32cf0cd733

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_s390.deb
Size/MD5 checksum: 531922 936b063457eca68d5a54a638d32a0134

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_sparc.deb
Size/MD5 checksum: 547274 adaaee0cdbfd7eaf552dec2de2f16f9b

-- Debian GNU/Linux unstable alias sid --

Fixed in version 5.0-10.

ORIGINAL ADVISORY:
http://www.debian.org/security/2003/dsa-333

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]