An updated nfs-utils-lib package to correct a security flaw is now
available for CentOS Linux 4.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
The nfs-utils-lib package contains support libraries that are needed by the
commands and daemons of the nfs-utils package.
Tenable Network Security discovered a stack buffer overflow flaw in the RPC
library used by nfs-utils-lib. A remote unauthenticated attacker who can
access an application linked against nfs-utils-lib could trigger this flaw
and cause the application to crash. On CentOS Linux 4 it is not
possible to exploit this flaw to run arbitrary code as the overflow is
blocked by FORTIFY_SOURCE. (CVE-2007-3999)
Users of nfs-utils-lib are advised to upgrade to this updated package,
which contains a backported patch that resolves this issue.