Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service Vulnerability

BID:8298

Info

Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service Vulnerability

Bugtraq ID: 8298
Class: Boundary Condition Error
CVE: CVE-2003-0619
Remote: Yes
Local: No
Published: Jul 29 2003 12:00AM
Updated: Jul 11 2009 10:56PM
Credit: Discovery of this vulnerability has been credited to Jared Stanbrough <[email protected]>.
Vulnerable: SuSE SUSE Linux Enterprise Server 8
+ Linux kernel 2.4.21
+ Linux kernel 2.4.19
SuSE Linux Enterprise Server 9
SuSE Linux Desktop 1.0
SuSE Linux 8.1
S.u.S.E. Novell Linux Desktop 1.0
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
Redhat kernel-utils-2.4-8.29.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-utils-2.4-8.13.i386.rpm
+ Redhat Linux 8.0
Redhat kernel-utils-2.4-7.4.i386.rpm
+ Redhat Linux 7.3
Redhat kernel-uml-2.4.18-14.i686.rpm
+ Redhat Linux 8.0
Redhat kernel-source-2.4.7-10.i386.rpm
+ Redhat Linux 7.2
Redhat kernel-source-2.4.20-8.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-source-2.4.2-2.i386.rpm
+ Redhat Linux 7.1
Redhat kernel-source-2.4.18-3.i386.rpm
+ Redhat Linux 7.3
Redhat kernel-source-2.4.18-14.i386.rpm
+ Redhat Linux 8.0
Redhat kernel-smp-2.4.7-10.i686.rpm
+ Redhat Linux 7.2
Redhat kernel-smp-2.4.7-10.i586.rpm
+ Redhat Linux 7.2
Redhat kernel-smp-2.4.7-10.athlon.rpm
+ Redhat Linux 7.2
Redhat kernel-smp-2.4.20-8.i686.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-smp-2.4.20-8.athlon.rpm
Redhat kernel-smp-2.4.2-2.i686.rpm
+ Redhat Linux 7.1
Redhat kernel-smp-2.4.2-2.i586.rpm
Redhat kernel-smp-2.4.18-3.i686.rpm
Redhat kernel-smp-2.4.18-3.i586.rpm
Redhat kernel-smp-2.4.18-3.athlon.rpm
+ Redhat Linux 7.3
Redhat kernel-smp-2.4.18-14.i686.rpm
Redhat kernel-smp-2.4.18-14.athlon.rpm
+ Redhat Linux 8.0
Redhat kernel-headers-2.4.7-10.i386.rpm
+ Redhat Linux 7.2
Redhat kernel-headers-2.4.2-2.i386.rpm
+ Redhat Linux 7.1
Redhat kernel-enterprise-2.4.2-2.i686.rpm
+ Redhat Linux 7.1
Redhat kernel-doc-2.4.7-10.i386.rpm
Redhat kernel-doc-2.4.20-8.i386.rpm
Redhat kernel-doc-2.4.2-2.i386.rpm
+ Redhat Linux 7.1
Redhat kernel-doc-2.4.18-3.i386.rpm
+ Redhat Linux 7.3
Redhat kernel-doc-2.4.18-14.i386.rpm
+ Redhat Linux 8.0
Redhat kernel-debug-2.4.18-3.i686.rpm
Redhat kernel-debug-2.4.18-14.i686.rpm
+ Redhat Linux 8.0
Redhat kernel-BOOT-2.4.7-10.i386.rpm
+ Redhat Linux 7.2
Redhat kernel-BOOT-2.4.20-8.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-BOOT-2.4.2-2.i386.rpm
+ Redhat Linux 7.1
Redhat kernel-BOOT-2.4.18-3.i386.rpm
+ Redhat Linux 7.3
Redhat kernel-BOOT-2.4.18-14.i386.rpm
Redhat kernel-bigmem-2.4.20-8.i686.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-bigmem-2.4.18-3.i686.rpm
+ Redhat Linux 7.3
Redhat kernel-bigmem-2.4.18-14.i686.rpm
+ Redhat Linux 8.0
Redhat kernel-2.4.7-10.i686.rpm
+ Redhat Linux 7.2
Redhat kernel-2.4.7-10.i386.rpm
+ Redhat Linux 7.2
Redhat kernel-2.4.7-10.athlon.rpm
+ Redhat Linux 7.2
Redhat kernel-2.4.20-8.i686.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-2.4.20-8.i586.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-2.4.20-8.athlon.rpm
+ Redhat Linux 9.0 i386
 Redhat kernel-2.4.2-2.i686.rpm
Redhat kernel-2.4.2-2.i586.rpm
Redhat kernel-2.4.2-2.i386.rpm
+ Redhat Linux 7.1
Redhat kernel-2.4.18-3.i686.rpm
+ Redhat Linux 7.3
Redhat kernel-2.4.18-3.i386.rpm
+ Redhat Linux 7.3
Redhat kernel-2.4.18-3.athlon.rpm
+ Redhat Linux 7.3
Redhat kernel-2.4.18-14.i686.rpm
+ Redhat Linux 8.0
Redhat kernel-2.4.18-14.i586.rpm
+ Redhat Linux 8.0
Redhat kernel-2.4.18-14.athlon.rpm
Linux kernel 2.4.21 pre4
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
Linux kernel 2.4.21 pre1
Linux kernel 2.4.21
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
+ Redhat Desktop 3.0
+ Redhat Enterprise Linux AS 3
 + Redhat Enterprise Linux ES 3
 + Redhat Enterprise Linux WS 3
 + S.u.S.E. Linux Personal 9.0 x86_64
 + S.u.S.E. Linux Personal 9.0
+ SuSE SUSE Linux Enterprise Server 8
 Linux kernel 2.4.20
Linux kernel 2.4.19 -pre6
Linux kernel 2.4.19 -pre5
Linux kernel 2.4.19 -pre4
Linux kernel 2.4.19 -pre3
Linux kernel 2.4.19 -pre2
Linux kernel 2.4.19 -pre1
Linux kernel 2.4.19
+ Conectiva Linux Enterprise Edition 1.0
+ MandrakeSoft Corporate Server 2.1 x86_64
 + MandrakeSoft Corporate Server 2.1
+ MandrakeSoft Multi Network Firewall 2.0
+ Mandriva Linux Mandrake 9.0
+ Slackware Linux -current
 + SuSE Linux 8.1
+ SuSE SUSE Linux Enterprise Server 8
 + SuSE SUSE Linux Enterprise Server 7
 Linux kernel 2.4.18 pre-8
Linux kernel 2.4.18 pre-7
Linux kernel 2.4.18 pre-6
Linux kernel 2.4.18 pre-5
Linux kernel 2.4.18 pre-4
Linux kernel 2.4.18 pre-3
Linux kernel 2.4.18 pre-2
Linux kernel 2.4.18 pre-1
Linux kernel 2.4.18 x86
Linux kernel 2.4.18
+ Astaro Security Linux 2.0 23
 + Astaro Security Linux 2.0 16
 + Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0
+ Redhat Advanced Workstation for the Itanium Processor 2.1 IA64
 + Redhat Advanced Workstation for the Itanium Processor 2.1
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Linux 8.0
+ Redhat Linux 7.3
+ S.u.S.E. Linux Connectivity Server
+ S.u.S.E. Linux Database Server 0
 + S.u.S.E. Linux Firewall on CD
+ S.u.S.E. Linux Office Server
+ S.u.S.E. Linux Personal 8.2
+ S.u.S.E. SuSE eMail Server 3.1
+ S.u.S.E. SuSE eMail Server III
+ SuSE Linux 8.1
+ SuSE Linux 8.0
+ SuSE Linux 7.3
+ SuSE Linux 7.2
+ SuSE Linux 7.1
+ SuSE Linux Openexchange Server
+ SuSE SUSE Linux Enterprise Server 8
 + SuSE SUSE Linux Enterprise Server 7
 + Turbolinux Turbolinux Server 8.0
+ Turbolinux Turbolinux Server 7.0
+ Turbolinux Turbolinux Workstation 8.0
+ Turbolinux Turbolinux Workstation 7.0
Linux kernel 2.4.17
Linux kernel 2.4.16
+ Sun Cobalt RaQ 550
Linux kernel 2.4.15
Linux kernel 2.4.14
Linux kernel 2.4.13
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Workstation 3.1.1
Linux kernel 2.4.12
Linux kernel 2.4.11
Linux kernel 2.4.10
Linux kernel 2.4.9
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.2 alpha
 + Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alpha
 + Sun Linux 5.0.5
+ Sun Linux 5.0.3
+ Sun Linux 5.0
Linux kernel 2.4.8
+ Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0
Linux kernel 2.4.7
+ Redhat Linux 7.2
+ SuSE Linux 7.2
+ SuSE Linux 7.1
Linux kernel 2.4.6
Linux kernel 2.4.5
+ Slackware Linux 8.0
Linux kernel 2.4.4
+ SuSE Linux 7.2
Linux kernel 2.4.3
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
Linux kernel 2.4.2
Linux kernel 2.4.1
Linux kernel 2.4 .0-test9
Linux kernel 2.4 .0-test8
Linux kernel 2.4 .0-test7
Linux kernel 2.4 .0-test6
Linux kernel 2.4 .0-test5
Linux kernel 2.4 .0-test4
Linux kernel 2.4 .0-test3
Linux kernel 2.4 .0-test2
Linux kernel 2.4 .0-test12
Linux kernel 2.4 .0-test11
Linux kernel 2.4 .0-test10
Linux kernel 2.4 .0-test1
Linux kernel 2.4
Not Vulnerable:

Discussion

Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service Vulnerability

Linux Kernel 2.4 XDR handler routines for NFSv3 have been reported prone to a remote denial of service vulnerability.

The issue presents itself in the XDR handler routine contained in the nfs3xdr.c kernel source file. The issue is due to a signed/unsigned mismatch, when processing the size field of an XDR packet.

A remote attacker may exploit this issue to trigger a kernel panic and deny service to legitimate users of the system.

Exploit / POC

Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service Vulnerability

The following proof of concept has been supplied:

Solution / Fix

Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service Vulnerability

Solution:
SuSE has released advisory SUSE-SA:2004:035 mainly to address the vulnerability described in BID 11281. However, in the addendum of this advisory, it is reported that fixes for the issues described in this BID are now available on the SuSE update FTP server for download. Customers are advised to see the referenced advisory for further information regarding obtaining and applying appropriate updates.

Debian has released advisory DSA 358-4 to address this issue.

Red Hat has released an advisory (RHSA-2003:198-16) containing updated IA64 fixes for Red Hat Enterprise Linux AS (v. 2.1) and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor. These fixes are only available through the Red Hat Network which can be found at http://rhn.redhat.com/.

Red Hat has also released an advisory (RHSA-2003-239) containing kernel fixes for Red Hat Enterprise Linux AS, ES, and WS(v. 2.1). These fixes are also only available through the Red Hat Network which can be found at http://rhn.redhat.com/.

Red Hat security advisory RHSA-2003:172-27 has been released to address this and other issues. However, this advisory is superceded by RHBA-2003:263-05, which addresses unrelated bugs but provides Kernel updates that include more recent fixes for this and other security vulnerabilities.

Conectiva has released a security advisory (CLSA-2003:730) containing fixes to address this issue in CLEE 1.0. Users are advised to upgrade as soon as possible.

Conectiva has released a security advisory (CLA-2003:796) containing fixes to address this issue in Conectiva Linux 8.

SuSE has released advisory SUSE-SA:2004:028 along with fixes dealing with this issue. Please see the referenced advisory for more information.

SuSE has released a second advisory dealing with this issue. Apparently the kernel shipped with SuSE Linux versions 8.1, 8.2, and 9.0 were not patched for this issue. Please see the referenced advisory for more information.


Redhat kernel-2.4.18-3.i686.rpm

Redhat kernel-2.4.2-2.i386.rpm

Redhat kernel-source-2.4.18-14.i386.rpm

Redhat kernel-bigmem-2.4.18-14.i686.rpm

Redhat kernel-BOOT-2.4.7-10.i386.rpm

Redhat kernel-doc-2.4.2-2.i386.rpm

Redhat kernel-2.4.20-8.athlon.rpm

Redhat kernel-source-2.4.2-2.i386.rpm

Redhat kernel-2.4.7-10.athlon.rpm

Redhat kernel-doc-2.4.18-3.i386.rpm

Redhat kernel-BOOT-2.4.20-8.i386.rpm

Redhat kernel-2.4.20-8.i586.rpm

Redhat kernel-2.4.7-10.i686.rpm

Redhat kernel-bigmem-2.4.20-8.i686.rpm

Redhat kernel-source-2.4.20-8.i386.rpm

Redhat kernel-2.4.20-8.i686.rpm

Redhat kernel-BOOT-2.4.18-3.i386.rpm

Redhat kernel-doc-2.4.18-14.i386.rpm

Redhat kernel-BOOT-2.4.2-2.i386.rpm

Redhat kernel-2.4.7-10.i386.rpm

Redhat kernel-2.4.18-3.athlon.rpm

Redhat kernel-2.4.18-3.i386.rpm

Redhat kernel-bigmem-2.4.18-3.i686.rpm

Redhat kernel-source-2.4.7-10.i386.rpm

Redhat kernel-2.4.18-14.i586.rpm

Redhat kernel-2.4.18-14.i686.rpm

Linux kernel 2.4.18

Linux kernel 2.4.19

References

Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report