Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2003.0842 -- SGI Security Advisory
rpc.mountd Vulnerabilities (update)
08 December 2003
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rpc.mountd
Publisher: SGI
Operating System: IRIX 6.5.18 through 6.5.22
Impact: Increased Privileges
Denial of Service
Access Required: Remote
CVE Names: CAN-1999-1225 CAN-2003-0796 CAN-2003-0797
Ref: ESB-2003.0809
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SGI Security Advisory
Title: rpc.mountd Vulnerabilities
Number: 20031102-02-P
Date: December 5, 2003
Reference: SGI BUG 897521, CVE CAN-1999-1225
Reference: SGI BUG 897523, CVE CAN-2003-0796
Reference: SGI BUG 898361, CVE CAN-2003-0797
Reference: SGI BUG 902638
Fixed in: Future release of IRIX and in patches 5426-5429
______________________________________________________________________________
SGI provides this information freely to the SGI user community for its
consideration, interpretation, implementation and use. SGI recommends
that this information be acted upon as soon as possible.
SGI provides the information in this Security Advisory on an "AS-IS"
basis only, and disclaims all warranties with respect thereto, express,
implied or otherwise, including, without limitation, any warranty of
merchantability or fitness for a particular purpose. In no event shall
SGI be liable for any loss of profits, loss of business, loss of data or
for any indirect, special, exemplary, incidental or consequential damages
of any kind arising from your use of, failure to use or improper use of
any of the instructions or information in this Security Advisory.
_____________________________________________________________________________
- - --------------
- - --- Update ---
- - --------------
This is an update to SGI Security Advisory 20031102-02-P.
The original patches 5387-5389 had a format mismatch between exportfs
and rpc.mountd. New patches 5426-5429 have been released to fix this
mismatch. (SGI BUG 902638)
- - -----------------------
- - --- Issue Specifics ---
- - -----------------------
It has been reported that there are multiple security vulnerabilities
in rpc.mountd effecting IRIX 6.5.18 through 6.5.22.
- users can probe the sgi_mountd RPC service for the presence or
absence of any file on the system. (CAN-1999-1225)
- under certain conditions rpc.mountd would allow mount requests from
unprivileged ports even if running without -n option. (CAN-2003-0796)
- rpc.mountd could be made to die remotely, effecting temporary DoS
against NFS services. (CAN-2003-0797)
SGI has investigated the issue and recommends the following steps for
neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures
be implemented on ALL vulnerable SGI systems. This issue has been
corrected in future releases of IRIX.
- - --------------
- - --- Impact ---
- - --------------
To determine the version of IRIX you are running, execute the following
command:
# /bin/uname -R
That will return a result similar to the following:
# 6.5 6.5.21f
The first number ("6.5") is the release name, the second ("6.5.21f" in
this case) is the extended release name. The extended release name
is the "version" we refer to throughout this document.
- - ----------------
- - --- Solution ---
- - ----------------
SGI has provided a series of patches for these vulnerabilities. Our
recommendation is to upgrade to IRIX 6.5.23, or install the appropriate
patches.
OS Version Vulnerable? Patch # Other Actions
- - ------------ ----------- ------- -------------
IRIX 6.5.18m yes 5427 Notes 1 & 2
IRIX 6.5.18f yes 5427 Notes 1 & 2
IRIX 6.5.19m yes 5429 Notes 1 & 2
IRIX 6.5.19f yes 5428 Notes 1 & 2
IRIX 6.5.20m yes 5427 Notes 1 & 2
IRIX 6.5.20f yes 5427 Notes 1 & 2
IRIX 6.5.21m yes 5426 Notes 1 & 2
IRIX 6.5.21f yes 5426 Notes 1 & 2
IRIX 6.5.22 yes 5426 Notes 1 & 2
NOTES
1) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact
your SGI Support Provider or visit URL: http://support.sgi.com/
2) Install the required patch(es) based on your operating release.
##### Patch File Checksums ####
The actual patch will be a tar file containing the following files:
Filename: README.patch.5426
Algorithm #1 (sum -r): 31340 8 README.patch.5426
Algorithm #2 (sum): 50827 8 README.patch.5426
MD5 checksum: 72BB8C63B7FB2D6E40A99F9B663C3CA5
Filename: patchSG0005426
Algorithm #1 (sum -r): 31337 2 patchSG0005426
Algorithm #2 (sum): 40486 2 patchSG0005426
MD5 checksum: FE6C70A9AE935323D64B63B7575235D8
Filename: patchSG0005426.idb
Algorithm #1 (sum -r): 30037 1 patchSG0005426.idb
Algorithm #2 (sum): 34980 1 patchSG0005426.idb
MD5 checksum: 94BA6526CEC9EE98B599CC121D3CE7A3
Filename: patchSG0005426.nfs_sw
Algorithm #1 (sum -r): 13211 40 patchSG0005426.nfs_sw
Algorithm #2 (sum): 28058 40 patchSG0005426.nfs_sw
MD5 checksum: 0CF044624210576E91F2ED9233CF77D5
Filename: README.patch.5427
Algorithm #1 (sum -r): 28385 8 README.patch.5427
Algorithm #2 (sum): 53044 8 README.patch.5427
MD5 checksum: 72C032D46BFAC961AFA61162BFDB5224
Filename: patchSG0005427
Algorithm #1 (sum -r): 54664 2 patchSG0005427
Algorithm #2 (sum): 44158 2 patchSG0005427
MD5 checksum: EABC1BFBD1580FA3D7ECC80FA422B22C
Filename: patchSG0005427.idb
Algorithm #1 (sum -r): 38844 1 patchSG0005427.idb
Algorithm #2 (sum): 34985 1 patchSG0005427.idb
MD5 checksum: 9269E278CE528410ED050DCA87CCFA6D
Filename: patchSG0005427.nfs_sw
Algorithm #1 (sum -r): 60309 40 patchSG0005427.nfs_sw
Algorithm #2 (sum): 60412 40 patchSG0005427.nfs_sw
MD5 checksum: 8CC7B808EDED3202AF69B469228347F9
Filename: README.patch.5428
Algorithm #1 (sum -r): 38179 12 README.patch.5428
Algorithm #2 (sum): 47094 12 README.patch.5428
MD5 checksum: 3FEFF76F660E051E1EB255C85AD1C1B3
Filename: patchSG0005428
Algorithm #1 (sum -r): 30871 15 patchSG0005428
Algorithm #2 (sum): 1466 15 patchSG0005428
MD5 checksum: CBF7812F05D9672B398F729C848113C9
Filename: patchSG0005428.dev_man
Algorithm #1 (sum -r): 28629 12 patchSG0005428.dev_man
Algorithm #2 (sum): 65088 12 patchSG0005428.dev_man
MD5 checksum: 76770F3C5AB120AF55F739DA42C99A40
Filename: patchSG0005428.dev_sw
Algorithm #1 (sum -r): 02962 2967 patchSG0005428.dev_sw
Algorithm #2 (sum): 51839 2967 patchSG0005428.dev_sw
MD5 checksum: A365F6B280286B77B35B549752E1A0A9
Filename: patchSG0005428.eoe_man
Algorithm #1 (sum -r): 10457 22 patchSG0005428.eoe_man
Algorithm #2 (sum): 12877 22 patchSG0005428.eoe_man
MD5 checksum: F724C951BAB9375863EE5927230BE2A6
Filename: patchSG0005428.eoe_sw
Algorithm #1 (sum -r): 32009 15678 patchSG0005428.eoe_sw
Algorithm #2 (sum): 45129 15678 patchSG0005428.eoe_sw
MD5 checksum: 96B65981FD29693D294E97C6B60F4AA4
Filename: patchSG0005428.eoe_sw64
Algorithm #1 (sum -r): 17257 5934 patchSG0005428.eoe_sw64
Algorithm #2 (sum): 18922 5934 patchSG0005428.eoe_sw64
MD5 checksum: EF55732A4E1AD60F12C16BBF40D9D987
Filename: patchSG0005428.idb
Algorithm #1 (sum -r): 21378 12 patchSG0005428.idb
Algorithm #2 (sum): 6087 12 patchSG0005428.idb
MD5 checksum: 4CB891C406029718F0B1DCF1A18BB352
Filename: patchSG0005428.irix_dev_sw
Algorithm #1 (sum -r): 42515 20 patchSG0005428.irix_dev_sw
Algorithm #2 (sum): 61566 20 patchSG0005428.irix_dev_sw
MD5 checksum: 20307991B48867256113BBA4E5A36109
Filename: patchSG0005428.nfs_sw
Algorithm #1 (sum -r): 29151 312 patchSG0005428.nfs_sw
Algorithm #2 (sum): 61247 312 patchSG0005428.nfs_sw
MD5 checksum: 80D8F5D446BCF0A7A63601EEE1F86A38
Filename: README.patch.5429
Algorithm #1 (sum -r): 65517 11 README.patch.5429
Algorithm #2 (sum): 30140 11 README.patch.5429
MD5 checksum: FCE5AFF54A8818A1BC43AAA90B3841A5
Filename: patchSG0005429
Algorithm #1 (sum -r): 64573 13 patchSG0005429
Algorithm #2 (sum): 55754 13 patchSG0005429
MD5 checksum: FD631DA9F7CB5A9D7CE784E886D23BE7
Filename: patchSG0005429.dev_man
Algorithm #1 (sum -r): 28629 12 patchSG0005429.dev_man
Algorithm #2 (sum): 65088 12 patchSG0005429.dev_man
MD5 checksum: 76770F3C5AB120AF55F739DA42C99A40
Filename: patchSG0005429.dev_sw
Algorithm #1 (sum -r): 14650 2910 patchSG0005429.dev_sw
Algorithm #2 (sum): 50752 2910 patchSG0005429.dev_sw
MD5 checksum: 94C08B781152EB925EACB2729B7EF8DC
Filename: patchSG0005429.eoe_man
Algorithm #1 (sum -r): 10457 22 patchSG0005429.eoe_man
Algorithm #2 (sum): 12877 22 patchSG0005429.eoe_man
MD5 checksum: F724C951BAB9375863EE5927230BE2A6
Filename: patchSG0005429.eoe_sw
Algorithm #1 (sum -r): 30718 15497 patchSG0005429.eoe_sw
Algorithm #2 (sum): 16913 15497 patchSG0005429.eoe_sw
MD5 checksum: 3C8E0F6DFE4B3FF03FD1AB40B6723B91
Filename: patchSG0005429.eoe_sw64
Algorithm #1 (sum -r): 20340 5826 patchSG0005429.eoe_sw64
Algorithm #2 (sum): 28507 5826 patchSG0005429.eoe_sw64
MD5 checksum: 0627D3F3427358CFF093790CFE7915D3
Filename: patchSG0005429.idb
Algorithm #1 (sum -r): 29898 11 patchSG0005429.idb
Algorithm #2 (sum): 60700 11 patchSG0005429.idb
MD5 checksum: B79B003164912BC59C81189211BC3235
Filename: patchSG0005429.irix_dev_sw
Algorithm #1 (sum -r): 29446 15 patchSG0005429.irix_dev_sw
Algorithm #2 (sum): 30495 15 patchSG0005429.irix_dev_sw
MD5 checksum: 0A0118E17B525C4D059CD36C2BAB5590
Filename: patchSG0005429.nfs_sw
Algorithm #1 (sum -r): 39301 312 patchSG0005429.nfs_sw
Algorithm #2 (sum): 33469 312 patchSG0005429.nfs_sw
MD5 checksum: 2D396ACDFE42E5F00A44625373AA9380
- - -------------
- - --- Links ---
- - -------------
Patches are available via the web, anonymous FTP and from your SGI
service/support provider.
SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/
SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/
SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/ and ftp://patches.sgi.com/
SGI freeware updates for IRIX can be found at:
http://freeware.sgi.com/
SGI fixes for SGI open sourced code can be found on:
http://oss.sgi.com/projects/
SGI patches and RPMs for Linux can be found at:
http://support.sgi.com/
SGI patches for Windows NT or 2000 can be found at:
http://support.sgi.com/
IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
http://support.sgi.com/
IRIX 6.5 Maintenance Release Streams can be found at:
http://support.sgi.com/
IRIX 6.5 Software Update CDs can be obtained from:
http://support.sgi.com/
The primary SGI anonymous FTP site for security advisories and patches
is patches.sgi.com (216.32.174.211). Security advisories and patches
are located under the URL ftp://patches.sgi.com/support/free/security/
- - ------------------------
- - --- Acknowledgments ----
- - ------------------------
SGI wishes to thank the users of the Internet Community at large for their
assistance in this matter.
- - -----------------------------------------
- - --- SGI Security Information/Contacts ---
- - -----------------------------------------
If there are questions about this document, email can be sent to
security-info@sgi.com.
------oOo------
SGI provides security information and patches for use by the entire SGI
community. This information is freely available to any person needing
the information and is available via anonymous FTP and the Web.
The primary SGI anonymous FTP site for security advisories and patches
is patches.sgi.com (216.32.174.211). Security advisories and patches
are located under the URL ftp://patches.sgi.com/support/free/security/
The SGI Security Headquarters Web page is accessible at the URL:
http://www.sgi.com/support/security/
For issues with the patches on the FTP sites, email can be sent to
security-info@sgi.com.
For assistance obtaining or working with security patches, please
contact your SGI support provider.
------oOo------
SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email)
all SGI Security Advisories when they are released. Subscribing to the
mailing list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html)
or by sending email to SGI as outlined below.
% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress such as midwatch@sgi.com >
end
^d
In the example above, <YourEmailAddress> is the email address that you
wish the mailing list information sent to. The word end must be on a
separate line to indicate the end of the body of the message. The
control-d (^d) is used to indicate to the mail program that you are
finished composing the mail message.
------oOo------
SGI provides a comprehensive customer World Wide Web site. This site is
located at http://www.sgi.com/support/security/ .
------oOo------
If there are general security questions on SGI systems, email can be
sent to security-info@sgi.com.
For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider. A
support contract is not required for submitting a security report.
______________________________________________________________________________
This information is provided freely to all interested parties
and may be redistributed provided that it is not altered in any
way, SGI is appropriately credited and the document retains and
includes its valid PGP signature.
- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBP9EKL7Q4cFApAP75AQFnuQQAh9Vy/9znC9OHWQAylIK3hyVqZtvThO4n
RpYV5fUEHAw+a2Ujmk8IFKzQreAWTux+Jen0EcvHcXl3zcWQ7hV4vMFTNvizxYGR
jIbAWtBI3P7OGmiLt2jmDXICDZ6FMrOu6wrMspPCoUFAYFcuJUc3oBQC5oDzBIy+
C4yycT1JBa4=
=UHTk
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBP9PHcyh9+71yA2DNAQGCaQQAlqojKku+hK+x+tg7nWUg5HPXQmRlXhLw
dIb7cjPZO97iSNTkS7W81S+wLEg2NBeqJX5Eq48Ef3OtF0Pao2cknwwrgWHrw2ip
ST6ocztJ+C1fYw8KaCdaAbrX9r4KHBtMvNZ4ukkIsTLPRNTCecGZWBV6lekVqabu
wtH24m6dR/I=
=dhCr
-----END PGP SIGNATURE-----