Debian Security Advisory

nis -- various security problems in nis

Date Reported:

27 Oct 1999

Affected Packages:

nis

Vulnerable:

Yes

Security database references:

More information:

The nis package that was distributed with Debian GNU/Linux 2.1 has a couple of problems:

ypserv allowed any machine in the NIS domain to insert new tables
rpc.yppasswd had a bufferoverflow in its MD5 code
rpc.yppasswd allowed users to change the GECOS and loginshell entries of other users

This has been fixed in version 3.5-2. We recommend you upgrade your nis package immediately.

Fixed in:

Source:: http://security.debian.org/dists/stable/updates/source/nis_3.5-2.diff.gz; http://security.debian.org/dists/stable/updates/source/nis_3.5-2.dsc; http://security.debian.org/dists/stable/updates/source/nis_3.5.orig.tar.gz
Alpha:: http://security.debian.org/dists/stable/updates/binary-alpha/nis_3.5-2_alpha.deb
i386:: http://security.debian.org/dists/stable/updates/binary-i386/nis_3.5-2_i386.deb
m68k:: http://security.debian.org/dists/stable/updates/binary-m68k/nis_3.5-2_m68k.deb
sparc:: http://security.debian.org/dists/stable/updates/binary-sparc/nis_3.5-2_sparc.deb