ypbind for Red Hat Linux 5.x, 6.x has a local root exploit

ypbind as shipped in Red Hat Linux 5.x and 6.x is vulnerable to a local
root exploit. All systems making use of NIS services are encouraged to
upgrade.

Systems using Network Information Service, or NIS, use a daemon called
ypbind to request information from a NIS server. This information is then
used by the local machine. The logging code in ypbind is vulnerable to a
printf string format attack which an attacker could exploit by passing
ypbind a carefully crafted request. This attack can successfully lead to
local root access.

This problem has been corrected with these new packages.

If you do not use NIS, you should remove ypbind:

rpm -e ypbind

Otherwise, for each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

You should then make sure that the new ypbind is running by issuing:

/etc/rc.d/init.d/ypbind restart

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1040
N/A

syslog