AUSCERT External Security Bulletin Redistribution

                  ESB-2003.0842 -- SGI Security Advisory
                    rpc.mountd Vulnerabilities (update)
                             08 December 2003


        AusCERT Security Bulletin Summary

Product:                rpc.mountd
Publisher:              SGI
Operating System:       IRIX 6.5.18 through 6.5.22
Impact:                 Increased Privileges
                        Denial of Service
Access Required:        Remote
CVE Names:              CAN-1999-1225 CAN-2003-0796 CAN-2003-0797

Ref:                    ESB-2003.0809

- --------------------------BEGIN INCLUDED TEXT--------------------



                          SGI Security Advisory

  Title:      rpc.mountd Vulnerabilities
  Number:     20031102-02-P
  Date:       December 5, 2003
  Reference:  SGI BUG 897521, CVE CAN-1999-1225
  Reference:  SGI BUG 897523, CVE CAN-2003-0796
  Reference:  SGI BUG 898361, CVE CAN-2003-0797
  Reference:  SGI BUG 902638
  Fixed in:   Future release of IRIX and in patches 5426-5429

SGI provides this information freely to the SGI user community for its
consideration, interpretation, implementation and use.   SGI recommends
that this information be acted upon as soon as possible.

SGI provides the information in this Security Advisory on an "AS-IS"
basis only, and disclaims all warranties with respect thereto, express,
implied or otherwise, including, without limitation, any warranty of
merchantability or fitness for a particular purpose.  In no event shall
SGI be liable for any loss of profits, loss of business, loss of data or

for any indirect, special, exemplary, incidental or consequential damages
of any kind arising from your use of, failure to use or improper use of
any of the instructions or information in this Security Advisory.

- - --------------
- - --- Update ---
- - --------------

This is an update to SGI Security Advisory 20031102-02-P.

The original patches 5387-5389 had a format mismatch between exportfs
and rpc.mountd. New patches 5426-5429 have been released to fix this
mismatch. (SGI BUG 902638)

- - -----------------------
- - --- Issue Specifics ---
- - -----------------------

It has been reported that there are multiple security vulnerabilities
in rpc.mountd effecting IRIX 6.5.18 through 6.5.22.

 - users can probe the sgi_mountd RPC service for the presence or
   absence of any file on the system. (CAN-1999-1225)

 - under certain conditions rpc.mountd would allow mount requests from
   unprivileged ports even if running without -n option. (CAN-2003-0796)

 - rpc.mountd could be made to die remotely, effecting temporary DoS
   against NFS services. (CAN-2003-0797)

SGI has investigated the issue and recommends the following steps for
neutralizing the exposure.  It is HIGHLY RECOMMENDED that these measures

be implemented on ALL vulnerable SGI systems.  This issue has been
corrected in future releases of IRIX.

- - --------------
- - --- Impact ---
- - --------------

To determine the version of IRIX you are running, execute the following

  # /bin/uname -R

That will return a result similar to the following:

  # 6.5 6.5.21f

The first number ("6.5") is the release name, the second ("6.5.21f" in
this case) is the extended release name.  The extended release name
is the "version" we refer to throughout this document.

- - ----------------
- - --- Solution ---
- - ----------------

SGI has provided a series of patches for these vulnerabilities. Our
recommendation is to upgrade to IRIX 6.5.23, or install the appropriate

OS Version     Vulnerable?     Patch #      Other Actions
- - ------------   -----------     -------      -------------
IRIX 6.5.18m      yes           5427         Notes 1 & 2
IRIX 6.5.18f      yes           5427         Notes 1 & 2
IRIX 6.5.19m      yes           5429         Notes 1 & 2
IRIX 6.5.19f      yes           5428         Notes 1 & 2
IRIX 6.5.20m      yes           5427         Notes 1 & 2
IRIX 6.5.20f      yes           5427         Notes 1 & 2
IRIX 6.5.21m      yes           5426         Notes 1 & 2
IRIX 6.5.21f      yes           5426         Notes 1 & 2
IRIX 6.5.22       yes           5426         Notes 1 & 2


     1) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact
        your SGI Support Provider or visit URL: http://support.sgi.com/

     2) Install the required patch(es) based on your operating release.

                 ##### Patch File Checksums ####

The actual patch will be a tar file containing the following files:
Filename:                 README.patch.5426
Algorithm #1 (sum -r):    31340 8 README.patch.5426
Algorithm #2 (sum):       50827 8 README.patch.5426
MD5 checksum:             72BB8C63B7FB2D6E40A99F9B663C3CA5

Filename:                 patchSG0005426
Algorithm #1 (sum -r):    31337 2 patchSG0005426
Algorithm #2 (sum):       40486 2 patchSG0005426
MD5 checksum:             FE6C70A9AE935323D64B63B7575235D8

Filename:                 patchSG0005426.idb
Algorithm #1 (sum -r):    30037 1 patchSG0005426.idb
Algorithm #2 (sum):       34980 1 patchSG0005426.idb
MD5 checksum:             94BA6526CEC9EE98B599CC121D3CE7A3

Filename:                 patchSG0005426.nfs_sw
Algorithm #1 (sum -r):    13211 40 patchSG0005426.nfs_sw
Algorithm #2 (sum):       28058 40 patchSG0005426.nfs_sw
MD5 checksum:             0CF044624210576E91F2ED9233CF77D5

Filename:                 README.patch.5427
Algorithm #1 (sum -r):    28385 8 README.patch.5427
Algorithm #2 (sum):       53044 8 README.patch.5427
MD5 checksum:             72C032D46BFAC961AFA61162BFDB5224

Filename:                 patchSG0005427
Algorithm #1 (sum -r):    54664 2 patchSG0005427
Algorithm #2 (sum):       44158 2 patchSG0005427
MD5 checksum:             EABC1BFBD1580FA3D7ECC80FA422B22C

Filename:                 patchSG0005427.idb
Algorithm #1 (sum -r):    38844 1 patchSG0005427.idb
Algorithm #2 (sum):       34985 1 patchSG0005427.idb
MD5 checksum:             9269E278CE528410ED050DCA87CCFA6D

Filename:                 patchSG0005427.nfs_sw
Algorithm #1 (sum -r):    60309 40 patchSG0005427.nfs_sw
Algorithm #2 (sum):       60412 40 patchSG0005427.nfs_sw
MD5 checksum:             8CC7B808EDED3202AF69B469228347F9

Filename:                 README.patch.5428
Algorithm #1 (sum -r):    38179 12 README.patch.5428
Algorithm #2 (sum):       47094 12 README.patch.5428
MD5 checksum:             3FEFF76F660E051E1EB255C85AD1C1B3

Filename:                 patchSG0005428
Algorithm #1 (sum -r):    30871 15 patchSG0005428
Algorithm #2 (sum):       1466 15 patchSG0005428
MD5 checksum:             CBF7812F05D9672B398F729C848113C9

Filename:                 patchSG0005428.dev_man
Algorithm #1 (sum -r):    28629 12 patchSG0005428.dev_man
Algorithm #2 (sum):       65088 12 patchSG0005428.dev_man
MD5 checksum:             76770F3C5AB120AF55F739DA42C99A40

Filename:                 patchSG0005428.dev_sw
Algorithm #1 (sum -r):    02962 2967 patchSG0005428.dev_sw
Algorithm #2 (sum):       51839 2967 patchSG0005428.dev_sw
MD5 checksum:             A365F6B280286B77B35B549752E1A0A9

Filename:                 patchSG0005428.eoe_man
Algorithm #1 (sum -r):    10457 22 patchSG0005428.eoe_man
Algorithm #2 (sum):       12877 22 patchSG0005428.eoe_man
MD5 checksum:             F724C951BAB9375863EE5927230BE2A6

Filename:                 patchSG0005428.eoe_sw
Algorithm #1 (sum -r):    32009 15678 patchSG0005428.eoe_sw
Algorithm #2 (sum):       45129 15678 patchSG0005428.eoe_sw
MD5 checksum:             96B65981FD29693D294E97C6B60F4AA4

Filename:                 patchSG0005428.eoe_sw64
Algorithm #1 (sum -r):    17257 5934 patchSG0005428.eoe_sw64
Algorithm #2 (sum):       18922 5934 patchSG0005428.eoe_sw64
MD5 checksum:             EF55732A4E1AD60F12C16BBF40D9D987

Filename:                 patchSG0005428.idb
Algorithm #1 (sum -r):    21378 12 patchSG0005428.idb
Algorithm #2 (sum):       6087 12 patchSG0005428.idb
MD5 checksum:             4CB891C406029718F0B1DCF1A18BB352

Filename:                 patchSG0005428.irix_dev_sw
Algorithm #1 (sum -r):    42515 20 patchSG0005428.irix_dev_sw
Algorithm #2 (sum):       61566 20 patchSG0005428.irix_dev_sw
MD5 checksum:             20307991B48867256113BBA4E5A36109

Filename:                 patchSG0005428.nfs_sw
Algorithm #1 (sum -r):    29151 312 patchSG0005428.nfs_sw
Algorithm #2 (sum):       61247 312 patchSG0005428.nfs_sw
MD5 checksum:             80D8F5D446BCF0A7A63601EEE1F86A38

Filename:                 README.patch.5429
Algorithm #1 (sum -r):    65517 11 README.patch.5429
Algorithm #2 (sum):       30140 11 README.patch.5429
MD5 checksum:             FCE5AFF54A8818A1BC43AAA90B3841A5

Filename:                 patchSG0005429
Algorithm #1 (sum -r):    64573 13 patchSG0005429
Algorithm #2 (sum):       55754 13 patchSG0005429
MD5 checksum:             FD631DA9F7CB5A9D7CE784E886D23BE7

Filename:                 patchSG0005429.dev_man
Algorithm #1 (sum -r):    28629 12 patchSG0005429.dev_man
Algorithm #2 (sum):       65088 12 patchSG0005429.dev_man
MD5 checksum:             76770F3C5AB120AF55F739DA42C99A40

Filename:                 patchSG0005429.dev_sw
Algorithm #1 (sum -r):    14650 2910 patchSG0005429.dev_sw
Algorithm #2 (sum):       50752 2910 patchSG0005429.dev_sw
MD5 checksum:             94C08B781152EB925EACB2729B7EF8DC

Filename:                 patchSG0005429.eoe_man
Algorithm #1 (sum -r):    10457 22 patchSG0005429.eoe_man
Algorithm #2 (sum):       12877 22 patchSG0005429.eoe_man
MD5 checksum:             F724C951BAB9375863EE5927230BE2A6

Filename:                 patchSG0005429.eoe_sw
Algorithm #1 (sum -r):    30718 15497 patchSG0005429.eoe_sw
Algorithm #2 (sum):       16913 15497 patchSG0005429.eoe_sw
MD5 checksum:             3C8E0F6DFE4B3FF03FD1AB40B6723B91

Filename:                 patchSG0005429.eoe_sw64
Algorithm #1 (sum -r):    20340 5826 patchSG0005429.eoe_sw64
Algorithm #2 (sum):       28507 5826 patchSG0005429.eoe_sw64
MD5 checksum:             0627D3F3427358CFF093790CFE7915D3

Filename:                 patchSG0005429.idb
Algorithm #1 (sum -r):    29898 11 patchSG0005429.idb
Algorithm #2 (sum):       60700 11 patchSG0005429.idb
MD5 checksum:             B79B003164912BC59C81189211BC3235

Filename:                 patchSG0005429.irix_dev_sw
Algorithm #1 (sum -r):    29446 15 patchSG0005429.irix_dev_sw
Algorithm #2 (sum):       30495 15 patchSG0005429.irix_dev_sw
MD5 checksum:             0A0118E17B525C4D059CD36C2BAB5590

Filename:                 patchSG0005429.nfs_sw
Algorithm #1 (sum -r):    39301 312 patchSG0005429.nfs_sw
Algorithm #2 (sum):       33469 312 patchSG0005429.nfs_sw
MD5 checksum:             2D396ACDFE42E5F00A44625373AA9380

- - -------------
- - --- Links ---
- - -------------

Patches are available via the web, anonymous FTP and from your SGI
service/support provider.

SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and

SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and

SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/ and ftp://patches.sgi.com/

SGI freeware updates for IRIX can be found at:

SGI fixes for SGI open sourced code can be found on:

SGI patches and RPMs for Linux can be found at:

SGI patches for Windows NT or 2000 can be found at:

IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:

IRIX 6.5 Maintenance Release Streams can be found at:

IRIX 6.5 Software Update CDs can be obtained from:

The primary SGI anonymous FTP site for security advisories and patches
is patches.sgi.com (  Security advisories and patches
are located under the URL ftp://patches.sgi.com/support/free/security/

- - ------------------------
- - --- Acknowledgments ----
- - ------------------------

SGI wishes to thank the users of the Internet Community at large for their
assistance in this matter.

- - -----------------------------------------
- - --- SGI Security Information/Contacts ---
- - -----------------------------------------

If there are questions about this document, email can be sent to


SGI provides security information and patches for use by the entire SGI
community.  This information is freely available to any person needing
the information and is available via anonymous FTP and the Web.

The primary SGI anonymous FTP site for security advisories and patches
is patches.sgi.com (  Security advisories and patches
are located under the URL ftp://patches.sgi.com/support/free/security/

The SGI Security Headquarters Web page is accessible at the URL:

For issues with the patches on the FTP sites, email can be sent to

For assistance obtaining or working with security patches, please
contact your SGI support provider.


SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email)
all SGI Security Advisories when they are released. Subscribing to the
mailing list can be done via the Web
or by sending email to SGI as outlined below.

% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress such as midwatch@sgi.com >

In the example above, <YourEmailAddress> is the email address that you
wish the mailing list information sent to.  The word end must be on a
separate line to indicate the end of the body of the message. The
control-d (^d) is used to indicate to the mail program that you are
finished composing the mail message.


SGI provides a comprehensive customer World Wide Web site. This site is
located at http://www.sgi.com/support/security/ .


If there are general security questions on SGI systems, email can be
sent to security-info@sgi.com.

For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider.  A
support contract is not required for submitting a security report.


      This information is provided freely to all interested parties
      and may be redistributed provided that it is not altered in any
      way, SGI is appropriately credited and the document retains and
      includes its valid PGP signature.

Version: 2.6.2


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:


Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967