Vulnerability Name:

CVE-2004-0946 (CCN-18455)

Assigned:2004-11-22
Published:2004-11-22
Updated:2018-10-19
Summary:rquotad in nfs-utils (rquota_server.c) before 1.0.6-r6 on 64-bit architectures does not properly perform an integer conversion, which leads to a stack-based buffer overflow and allows remote attackers to execute arbitrary code via a crafted NFS request.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Bugzilla Bug 72113
net-fs/nfs-utils: buffer overflow on 64bit arches and remote DoS

Source: MISC
Type: UNKNOWN
http://bugs.gentoo.org/show_bug.cgi?id=72113

Source: MITRE
Type: CNA
CVE-2004-0946

Source: CCN
Type: RHSA-2004-583
nfs-utils security update

Source: CCN
Type: RHSA-2005-014
nfs-utils security update

Source: CCN
Type: SA13440
nfs-utils "getquotainfo()" Buffer Overflow Vulnerability

Source: SECUNIA
Type: UNKNOWN
13440

Source: CCN
Type: CIAC Information Bulletin P-076
"nfs-utils" Package Vulnerabilities

Source: CCN
Type: GLSA-200412-08
nfs-utils: Multiple remote vulnerabilities

Source: GENTOO
Type: Patch, Vendor Advisory
GLSA-200412-08

Source: CCN
Type: US-CERT VU#698302
nfs-utils vulnerable to buffer overflow in getquotainfo() in rquota_server.c

Source: CERT-VN
Type: US Government Resource
VU#698302

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2005:005

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2004:583

Source: REDHAT
Type: UNKNOWN
RHSA-2005:014

Source: FEDORA
Type: UNKNOWN
FLSA-2006:138098

Source: BID
Type: Patch, Vendor Advisory
11911

Source: CCN
Type: BID-11911
Linux NFS 64-Bit Architecture Remote Buffer Overflow Vulnerability

Source: CCN
Type: TLSA-2005-33
NFS denial of service attack

Source: XF
Type: UNKNOWN
nfsutils-getquotainfo-bo(18455)

Source: XF
Type: UNKNOWN
nfsutils-getquotainfo-bo(18455)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10464

Vulnerable Configuration:Configuration 1:
  • cpe:/a:nfs:nfs-utils:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:nfs:nfs-utils:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:nfs:nfs-utils:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:nfs:nfs-utils:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:nfs:nfs-utils:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:nfs:nfs-utils:1.0.6:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:redhat:enterprise_linux:3.0:*:advanced_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:enterprise_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:workstation_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:linux-nfs:nfs-utils:0.1.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:10464
    V
    		rquotad in nfs-utils (rquota_server.c) before 1.0.6-r6 on 64-bit architectures does not properly perform an integer conversion, which leads to a stack-based buffer overflow and allows remote attackers to execute arbitrary code via a crafted NFS request.
    2013-04-29
    oval:com.redhat.rhsa:def:20040583
    P
    		RHSA-2004:583: nfs-utils security update (Important)
    2004-12-20
    BACK
    nfs nfs-utils 1.0
    nfs nfs-utils 1.0.1
    nfs nfs-utils 1.0.2
    nfs nfs-utils 1.0.3
    nfs nfs-utils 1.0.4
    nfs nfs-utils 1.0.6
    redhat enterprise linux 3.0
    redhat enterprise linux 3.0
    redhat enterprise linux 3.0
    redhat enterprise linux desktop 3.0
    linux-nfs nfs-utils 0.1.1
    gentoo linux *
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    mandrakesoft mandrake linux 9.2
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux 10.0
    redhat enterprise linux 3
    mandrakesoft mandrake linux 10.1
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 10.1
    turbolinux turbolinux home *
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux corporate server 2.1