[Secure-testing-team] Bug#720287: nas: CVE-2013-4256 CVE-2013-4257 CVE-2013-4258

[Salvatore Bonaccorso]

Package: nas
Severity: grave
Tags: security upstream patch

Hi,

the following vulnerabilities were published for nas (originally
reported by Hamid Zamani):

CVE-2013-4256[0]:
Buffer Overflows

CVE-2013-4257[1]:
Heap Overflow

CVE-2013-4258[2]:
Format string

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

Patches are also available, see [3] and [4].

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4256
    http://security-tracker.debian.org/tracker/CVE-2013-4256
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4257
    http://security-tracker.debian.org/tracker/CVE-2013-4257
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4258
    http://security-tracker.debian.org/tracker/CVE-2013-4258
[3] http://radscan.com/pipermail/nas/2013-August/001270.html
[4] http://marc.info/?l=oss-security&m=137694353908055&w=2

Please adjust the affected versions in the BTS as needed, 1.9.3 was
confirmed by the reporter, but might also be present in 1.9.2.

Regards,
Salvatore