1

We need to solve vulnerability CVE-2011-4191

"Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets."

We don't know version of XNFS.NLM in this CVE.

Going to patch description (http://download.novell.com/Download?buildid=Cfw1tDezgbw~). No info about vulnerable XNFS.NLM version. No info about version of secure XNFS.NLM. Some instruction how to replace vulnerable NLM to new one.

So, question: how to detect that XNFS.NLM is already patched or not?

Thank you for your answers!

Improve this question

1 Answer 1

Reset to default
2

At the console of the server, use the MODULES command, which is also aliased to M.

So, m xnfs.nlm should be sufficient to report the date and version of this build.

Often times they forget to increment build numbers so it is not 100% but in the case of this patch, the date would be a giveaway. If it is not really recent, you are likely not patched.

Improve this answer
1
  • @ptt35t Not so much date on the file itself, but date embedded within the file. It is not 'proof' but if the xnfs.nlm is from 2002 and the bug is patched as of 2007 it is pretty darn clear you are not patched. But actually it is the internal version number that is a better indicator.
    – geoffc
    Dec 8, 2011 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .