Signature Detail
Short Name |
RPC:RPC.STATD:STATD-FMT-STR1 |
|---|---|
Severity |
Critical |
Recommended |
No |
Recommended Action |
Drop |
Category |
RPC |
Keywords |
RPC.statd Linux Remote Format String Attack (1) |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
RPC: RPC.statd Linux Remote Format String Attack (1)
This signature detects attempts to exploit the format string vulnerability in the rpc.statd program, an RPC server that is included with the nfs-utils packages distributed with some Linux distributions. The logging code in rpc.statd allows a remote call to syslog() to access user supplied data. Attackers can send a maliciously crafted RPC message that injects executable code into the process address space, overwriting the function's return address, and forcing the program to execute the malicious code with root privileges.
Extended Description
A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux distributions. Because of a format-string vulnerability when calling the 'syslog()' function, a remote attacker can execute code as root. The 'rpc.statd' server is an RPC server that implements the Network Status and Monitor RPC protocol. It's a component of the Network File System (NFS) architecture. The logging code in 'rpc.statd' uses the 'syslog()' function, passing it as the format string user-supplied data. A malicious user can construct a format string that injects executable code into the process address space and overwrites a function's return address, thus forcing the program to execute the code. The 'rpc.statd' server requires root privileges for opening its network socket, but fails to drop these privileges later on. Therefore, code run by the malicious user will execute with root privileges. Debian, Red Hat, and Connectiva have all released advisories. Presumably, any Linux distribution that runs the statd process is vulnerable unless patched for the problem.
Affected Products
- Conectiva Linux 4.0.0
- Conectiva Linux 4.0.0 es
- Conectiva Linux 4.1.0
- Conectiva Linux 4.2.0
- Conectiva Linux 5.0.0
- Conectiva Linux 5.1.0
- Debian Linux 2.2.0
- Debian Linux 2.2.0 alpha
- Debian Linux 2.2.0 Powerpc
- Debian Linux 2.2.0 sparc
- Debian Linux 2.3.0
- Debian Linux 2.3.0 alpha
- Debian Linux 2.3.0 powerpc
- Debian Linux 2.3.0 sparc
- Red Hat Linux 6.0.0
- Red Hat Linux 6.0.0 Alpha
- Red Hat Linux 6.0.0 Sparc
- Red Hat Linux 6.1.0 Alpha
- Red Hat Linux 6.1.0 I386
- Red Hat Linux 6.1.0 Sparc
- Red Hat Linux 6.2.0 Alpha
- Red Hat Linux 6.2.0 I386
- Red Hat Linux 6.2.0 Sparc
- Red Hat nfs-utils-0.1.6-2.i386.rpm
- SuSE Linux 6.3.0
- SuSE Linux 6.3.0 alpha
- SuSE Linux 6.3.0 ppc
- SuSE Linux 6.4.0
- SuSE Linux 6.4.0 Alpha
- SuSE Linux 6.4.0 ppc
- SuSE Linux 7.0.0
- Trustix Trustix Secure Linux 1.0.0
- Trustix Trustix Secure Linux 1.1.0
References