rpc.mountd Vulnerabilities on SGI IRIX
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SGI Security Advisory
Title: rpc.mountd Vulnerabilities
Number: 20031102-01-P
Date: November, 21 2003
Reference: SGI BUG 897521, CVE CAN-1999-1225
Reference: SGI BUG 897523, CVE CAN-2003-0796
Reference: SGI BUG 898361, CVE CAN-2003-0797
Fixed in: Future release of IRIX and in patches 5387, 5388 and 5389
______________________________________________________________________________
SGI provides this information freely to the SGI user community for its
consideration, interpretation, implementation and use. SGI recommends
that this information be acted upon as soon as possible.
SGI provides the information in this Security Advisory on an "AS-IS"
basis only, and disclaims all warranties with respect thereto, express,
implied or otherwise, including, without limitation, any warranty of
merchantability or fitness for a particular purpose. In no event shall
SGI be liable for any loss of profits, loss of business, loss of data or
for any indirect, special, exemplary, incidental or consequential damages
of any kind arising from your use of, failure to use or improper use of
any of the instructions or information in this Security Advisory.
_____________________________________________________________________________
- -----------------------
- --- Issue Specifics ---
- -----------------------
It has been reported that there are multiple security vulnerabilities
in rpc.mountd effecting IRIX 6.5.18 through 6.5.22.
- users can probe the sgi_mountd RPC service for the presence or
absence of any file on the system. (CAN-1999-1225)
- under certain conditions rpc.mountd would allow mount requests from
unprivileged ports even if running without -n option. (CAN-2003-0796)
- rpc.mountd could be made to die remotely, effecting temporary DoS
against NFS services. (CAN-2003-0797)
SGI has investigated the issue and recommends the following steps for
neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures
be implemented on ALL vulnerable SGI systems. This issue has been
corrected in future releases of IRIX.
- --------------
- --- Impact ---
- --------------
To determine the version of IRIX you are running, execute the following
command:
# /bin/uname -R
That will return a result similar to the following:
# 6.5 6.5.21f
The first number ("6.5") is the release name, the second ("6.5.21f" in
this case) is the extended release name. The extended release name
is the "version" we refer to throughout this document.
- ----------------
- --- Solution ---
- ----------------
SGI has provided a series of patches for these vulnerabilities. Our
recommendation is to upgrade to IRIX 6.5.23, or install the appropriate
patches.
OS Version Vulnerable? Patch # Other Actions
- ---------- ----------- ------- -------------
IRIX 3.x unknown Note 1
IRIX 4.x unknown Note 1
IRIX 5.x unknown Note 1
IRIX 6.0.x unknown Note 1
IRIX 6.1 unknown Note 1
IRIX 6.2 unknown Note 1
IRIX 6.3 unknown Note 1
IRIX 6.4 unknown Note 1
IRIX 6.5 yes Note 2
IRIX 6.5.1 yes Note 2
IRIX 6.5.2 yes Note 2
IRIX 6.5.3 yes Note 2
IRIX 6.5.4 yes Note 2
IRIX 6.5.5 yes Note 2
IRIX 6.5.6 yes Note 2
IRIX 6.5.7 yes Note 2
IRIX 6.5.8 yes Note 2
IRIX 6.5.9 yes Note 2
IRIX 6.5.10 yes Note 2
IRIX 6.5.11 yes Note 2
IRIX 6.5.12 yes Note 2
IRIX 6.5.13 yes Note 2
IRIX 6.5.14 yes Note 2
IRIX 6.5.15 yes Note 2
IRIX 6.5.16 yes Note 2
IRIX 6.5.17m yes Note 2
IRIX 6.5.17f yes Note 2
IRIX 6.5.18m yes 5387 Notes 2 & 3
IRIX 6.5.18f yes 5387 Notes 2 & 3
IRIX 6.5.19m yes 5389 Notes 2 & 3
IRIX 6.5.19f yes 5388 Notes 2 & 3
IRIX 6.5.20m yes 5387 Notes 2 & 3
IRIX 6.5.20f yes 5387 Notes 2 & 3
IRIX 6.5.21m yes 5387 Notes 2 & 3
IRIX 6.5.21f yes 5387 Notes 2 & 3
IRIX 6.5.22 yes 5387 Notes 2 & 3
NOTES
1) This version of the IRIX operating has been retired. Upgrade to
an actively supported IRIX operating system. See
http://support.sgi.com for more information.
2) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact
your SGI Support Provider or URL: http://support.sgi.com/
3) Install the required patch(es) based on your operating release.
##### Patch File Checksums ####
The actual patch will be a tar file containing the following files:
Filename: README.patch.5387
Algorithm #1 (sum -r): 13738 8 README.patch.5387
Algorithm #2 (sum): 56714 8 README.patch.5387
MD5 checksum: 546B4038EDFF947883C72B5418009509
Filename: patchSG0005387
Algorithm #1 (sum -r): 12622 2 patchSG0005387
Algorithm #2 (sum): 51041 2 patchSG0005387
MD5 checksum: 895C5AA74ABC757F1658E7034C6C1B15
Filename: patchSG0005387.idb
Algorithm #1 (sum -r): 29149 1 patchSG0005387.idb
Algorithm #2 (sum): 35018 1 patchSG0005387.idb
MD5 checksum: 5431FD9730DF3E422945EDA1F8DC28CF
Filename: patchSG0005387.nfs_sw
Algorithm #1 (sum -r): 12077 40 patchSG0005387.nfs_sw
Algorithm #2 (sum): 32159 40 patchSG0005387.nfs_sw
MD5 checksum: FDDD3EC309F48DA7AC903C49DDC333D4
Filename: README.patch.5388
Algorithm #1 (sum -r): 09744 12 README.patch.5388
Algorithm #2 (sum): 48295 12 README.patch.5388
MD5 checksum: B26E9A003E0DFA7EA1AC7779E570AB32
Filename: patchSG0005388
Algorithm #1 (sum -r): 34054 14 patchSG0005388
Algorithm #2 (sum): 23803 14 patchSG0005388
MD5 checksum: 4780A3E808AC0D65E58FF81DC806305D
Filename: patchSG0005388.dev_man
Algorithm #1 (sum -r): 28629 12 patchSG0005388.dev_man
Algorithm #2 (sum): 65088 12 patchSG0005388.dev_man
MD5 checksum: 76770F3C5AB120AF55F739DA42C99A40
Filename: patchSG0005388.dev_sw
Algorithm #1 (sum -r): 00140 2966 patchSG0005388.dev_sw
Algorithm #2 (sum): 50371 2966 patchSG0005388.dev_sw
MD5 checksum: 13D2974EC7C2A0465AF71CC241356AC7
Filename: patchSG0005388.eoe_man
Algorithm #1 (sum -r): 10457 22 patchSG0005388.eoe_man
Algorithm #2 (sum): 12877 22 patchSG0005388.eoe_man
MD5 checksum: F724C951BAB9375863EE5927230BE2A6
Filename: patchSG0005388.eoe_sw
Algorithm #1 (sum -r): 50331 15682 patchSG0005388.eoe_sw
Algorithm #2 (sum): 54684 15682 patchSG0005388.eoe_sw
MD5 checksum: 696F795781D63CCC199D54278275E3BE
Filename: patchSG0005388.eoe_sw64
Algorithm #1 (sum -r): 64282 5949 patchSG0005388.eoe_sw64
Algorithm #2 (sum): 47004 5949 patchSG0005388.eoe_sw64
MD5 checksum: 9F5B215C66CB424B964FCD9990D3411E
Filename: patchSG0005388.idb
Algorithm #1 (sum -r): 30535 12 patchSG0005388.idb
Algorithm #2 (sum): 6550 12 patchSG0005388.idb
MD5 checksum: D8706F00C8F3C9EED9BF786BFC56F220
Filename: patchSG0005388.irix_dev_sw
Algorithm #1 (sum -r): 42515 20 patchSG0005388.irix_dev_sw
Algorithm #2 (sum): 61566 20 patchSG0005388.irix_dev_sw
MD5 checksum: 20307991B48867256113BBA4E5A36109
Filename: patchSG0005388.nfs_sw
Algorithm #1 (sum -r): 25751 312 patchSG0005388.nfs_sw
Algorithm #2 (sum): 37078 312 patchSG0005388.nfs_sw
MD5 checksum: 88FE54A4AA6377B44864093606F9A99B
Filename: README.patch.5389
Algorithm #1 (sum -r): 35523 11 README.patch.5389
Algorithm #2 (sum): 30241 11 README.patch.5389
MD5 checksum: 6655DAF16C2F74B8C631891DA2F1ED4F
Filename: patchSG0005389
Algorithm #1 (sum -r): 41226 12 patchSG0005389
Algorithm #2 (sum): 12621 12 patchSG0005389
MD5 checksum: 891BF40B7BA9FC05A06F26D9156A4C86
Filename: patchSG0005389.dev_man
Algorithm #1 (sum -r): 28629 12 patchSG0005389.dev_man
Algorithm #2 (sum): 65088 12 patchSG0005389.dev_man
MD5 checksum: 76770F3C5AB120AF55F739DA42C99A40
Filename: patchSG0005389.dev_sw
Algorithm #1 (sum -r): 51682 2911 patchSG0005389.dev_sw
Algorithm #2 (sum): 48032 2911 patchSG0005389.dev_sw
MD5 checksum: 730CDAA9427FAAC4F5C0140351362E17
Filename: patchSG0005389.eoe_man
Algorithm #1 (sum -r): 10457 22 patchSG0005389.eoe_man
Algorithm #2 (sum): 12877 22 patchSG0005389.eoe_man
MD5 checksum: F724C951BAB9375863EE5927230BE2A6
Filename: patchSG0005389.eoe_sw
Algorithm #1 (sum -r): 61166 15412 patchSG0005389.eoe_sw
Algorithm #2 (sum): 16709 15412 patchSG0005389.eoe_sw
MD5 checksum: D2A905650D8B7255FB25266D94E7804B
Filename: patchSG0005389.eoe_sw64
Algorithm #1 (sum -r): 38810 5826 patchSG0005389.eoe_sw64
Algorithm #2 (sum): 49740 5826 patchSG0005389.eoe_sw64
MD5 checksum: FF1C98F7CE3E97C96B0FC765EAC89488
Filename: patchSG0005389.idb
Algorithm #1 (sum -r): 63367 11 patchSG0005389.idb
Algorithm #2 (sum): 60855 11 patchSG0005389.idb
MD5 checksum: E7BD1FEF25AA71ABE646D02BDFF36479
Filename: patchSG0005389.irix_dev_sw
Algorithm #1 (sum -r): 29446 15 patchSG0005389.irix_dev_sw
Algorithm #2 (sum): 30495 15 patchSG0005389.irix_dev_sw
MD5 checksum: 0A0118E17B525C4D059CD36C2BAB5590
Filename: patchSG0005389.nfs_sw
Algorithm #1 (sum -r): 33813 312 patchSG0005389.nfs_sw
Algorithm #2 (sum): 25763 312 patchSG0005389.nfs_sw
MD5 checksum: 2B99216B0356624781EC12A1B1B422B3
- -------------
- --- Links ---
- -------------
Patches are available via the web, anonymous FTP and from your SGI
service/support provider.
SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/
SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/
SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/ and ftp://patches.sgi.com/
SGI freeware updates for IRIX can be found at:
http://freeware.sgi.com/
SGI fixes for SGI open sourced code can be found on:
http://oss.sgi.com/projects/
SGI patches and RPMs for Linux can be found at:
http://support.sgi.com/
SGI patches for Windows NT or 2000 can be found at:
http://support.sgi.com/
IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
http://support.sgi.com/
IRIX 6.5 Maintenance Release Streams can be found at:
http://support.sgi.com/
IRIX 6.5 Software Update CDs can be obtained from:
http://support.sgi.com/
The primary SGI anonymous FTP site for security advisories and patches
is patches.sgi.com (216.32.174.211). Security advisories and patches
are located under the URL ftp://patches.sgi.com/support/free/security/
- ------------------------
- --- Acknowledgments ----
- ------------------------
SGI wishes to thank the users of the Internet Community at large for their
assistance in this matter.
- -----------------------------------------
- --- SGI Security Information/Contacts ---
- -----------------------------------------
If there are questions about this document, email can be sent to
security-info@xxxxxxxx
------oOo------
SGI provides security information and patches for use by the entire SGI
community. This information is freely available to any person needing
the information and is available via anonymous FTP and the Web.
The primary SGI anonymous FTP site for security advisories and patches
is patches.sgi.com (216.32.174.211). Security advisories and patches
are located under the URL ftp://patches.sgi.com/support/free/security/
The SGI Security Headquarters Web page is accessible at the URL:
http://www.sgi.com/support/security/
For issues with the patches on the FTP sites, email can be sent to
security-info@xxxxxxxx
For assistance obtaining or working with security patches, please
contact your SGI support provider.
------oOo------
SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email)
all SGI Security Advisories when they are released. Subscribing to the
mailing list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html)
or by sending email to SGI as outlined below.
% mail wiretap-request@xxxxxxx
subscribe wiretap <YourEmailAddress such as midwatch@xxxxxxx >
end
^d
In the example above, <YourEmailAddress> is the email address that you
wish the mailing list information sent to. The word end must be on a
separate line to indicate the end of the body of the message. The
control-d (^d) is used to indicate to the mail program that you are
finished composing the mail message.
------oOo------
SGI provides a comprehensive customer World Wide Web site. This site is
located at http://www.sgi.com/support/security/ .
------oOo------
If there are general security questions on SGI systems, email can be
sent to security-info@xxxxxxxx
For reporting *NEW* SGI security issues, email can be sent to
security-alert@xxxxxxx or contact your SGI support provider. A
support contract is not required for submitting a security report.
______________________________________________________________________________
This information is provided freely to all interested parties
and may be redistributed provided that it is not altered in any
way, SGI is appropriately credited and the document retains and
includes its valid PGP signature.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBP75hYLQ4cFApAP75AQFl6AP+KrkeFwm4qC7iA8qicdQRKguBl5eJGRim
SStioeW/JcnVgLVaZ2/ht9UxcfJyfnAcGZRJ9FZbF5jmRPrDWmva7O6z0GUl4Ysp
GjG4XaOUHkICTGy5aqNNdDHJaexQRUqxV5ha7ZnjDQfx8f8oCLk3HP/au7BcZdp3
vv2xCAjh6Mw=
=JmMM
-----END PGP SIGNATURE-----