From agent99@sgi.com Mon Dec 8 13:06:23 2003 From: SGI Security Coordinator To: agent99@sgi.com Cc: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, vulnwatch@vulnwatch.org Newsgroups: comp.sys.sgi.announce, comp.security.unix, comp.sys.sgi.admin, comp.security.announce Date: Fri, 5 Dec 2003 15:02:04 -0800 Subject: rpc.mountd Vulnerabilities update on IRIX -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SGI Security Advisory Title: rpc.mountd Vulnerabilities Number: 20031102-02-P Date: December 5, 2003 Reference: SGI BUG 897521, CVE CAN-1999-1225 Reference: SGI BUG 897523, CVE CAN-2003-0796 Reference: SGI BUG 898361, CVE CAN-2003-0797 Reference: SGI BUG 902638 Fixed in: Future release of IRIX and in patches 5426-5429 ______________________________________________________________________________ SGI provides this information freely to the SGI user community for its consideration, interpretation, implementation and use. SGI recommends that this information be acted upon as soon as possible. SGI provides the information in this Security Advisory on an "AS-IS" basis only, and disclaims all warranties with respect thereto, express, implied or otherwise, including, without limitation, any warranty of merchantability or fitness for a particular purpose. In no event shall SGI be liable for any loss of profits, loss of business, loss of data or for any indirect, special, exemplary, incidental or consequential damages of any kind arising from your use of, failure to use or improper use of any of the instructions or information in this Security Advisory. _____________________________________________________________________________ - -------------- - --- Update --- - -------------- This is an update to SGI Security Advisory 20031102-02-P. The original patches 5387-5389 had a format mismatch between exportfs and rpc.mountd. New patches 5426-5429 have been released to fix this mismatch. (SGI BUG 902638) - ----------------------- - --- Issue Specifics --- - ----------------------- It has been reported that there are multiple security vulnerabilities in rpc.mountd effecting IRIX 6.5.18 through 6.5.22. - users can probe the sgi_mountd RPC service for the presence or absence of any file on the system. (CAN-1999-1225) - under certain conditions rpc.mountd would allow mount requests from unprivileged ports even if running without -n option. (CAN-2003-0796) - rpc.mountd could be made to die remotely, effecting temporary DoS against NFS services. (CAN-2003-0797) SGI has investigated the issue and recommends the following steps for neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures be implemented on ALL vulnerable SGI systems. This issue has been corrected in future releases of IRIX. - -------------- - --- Impact --- - -------------- To determine the version of IRIX you are running, execute the following command: # /bin/uname -R That will return a result similar to the following: # 6.5 6.5.21f The first number ("6.5") is the release name, the second ("6.5.21f" in this case) is the extended release name. The extended release name is the "version" we refer to throughout this document. - ---------------- - --- Solution --- - ---------------- SGI has provided a series of patches for these vulnerabilities. Our recommendation is to upgrade to IRIX 6.5.23, or install the appropriate patches. OS Version Vulnerable? Patch # Other Actions - ------------ ----------- ------- ------------- IRIX 6.5.18m yes 5427 Notes 1 & 2 IRIX 6.5.18f yes 5427 Notes 1 & 2 IRIX 6.5.19m yes 5429 Notes 1 & 2 IRIX 6.5.19f yes 5428 Notes 1 & 2 IRIX 6.5.20m yes 5427 Notes 1 & 2 IRIX 6.5.20f yes 5427 Notes 1 & 2 IRIX 6.5.21m yes 5426 Notes 1 & 2 IRIX 6.5.21f yes 5426 Notes 1 & 2 IRIX 6.5.22 yes 5426 Notes 1 & 2 NOTES 1) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact your SGI Support Provider or visit URL: http://support.sgi.com/ 2) Install the required patch(es) based on your operating release. ##### Patch File Checksums #### The actual patch will be a tar file containing the following files: Filename: README.patch.5426 Algorithm #1 (sum -r): 31340 8 README.patch.5426 Algorithm #2 (sum): 50827 8 README.patch.5426 MD5 checksum: 72BB8C63B7FB2D6E40A99F9B663C3CA5 Filename: patchSG0005426 Algorithm #1 (sum -r): 31337 2 patchSG0005426 Algorithm #2 (sum): 40486 2 patchSG0005426 MD5 checksum: FE6C70A9AE935323D64B63B7575235D8 Filename: patchSG0005426.idb Algorithm #1 (sum -r): 30037 1 patchSG0005426.idb Algorithm #2 (sum): 34980 1 patchSG0005426.idb MD5 checksum: 94BA6526CEC9EE98B599CC121D3CE7A3 Filename: patchSG0005426.nfs_sw Algorithm #1 (sum -r): 13211 40 patchSG0005426.nfs_sw Algorithm #2 (sum): 28058 40 patchSG0005426.nfs_sw MD5 checksum: 0CF044624210576E91F2ED9233CF77D5 Filename: README.patch.5427 Algorithm #1 (sum -r): 28385 8 README.patch.5427 Algorithm #2 (sum): 53044 8 README.patch.5427 MD5 checksum: 72C032D46BFAC961AFA61162BFDB5224 Filename: patchSG0005427 Algorithm #1 (sum -r): 54664 2 patchSG0005427 Algorithm #2 (sum): 44158 2 patchSG0005427 MD5 checksum: EABC1BFBD1580FA3D7ECC80FA422B22C Filename: patchSG0005427.idb Algorithm #1 (sum -r): 38844 1 patchSG0005427.idb Algorithm #2 (sum): 34985 1 patchSG0005427.idb MD5 checksum: 9269E278CE528410ED050DCA87CCFA6D Filename: patchSG0005427.nfs_sw Algorithm #1 (sum -r): 60309 40 patchSG0005427.nfs_sw Algorithm #2 (sum): 60412 40 patchSG0005427.nfs_sw MD5 checksum: 8CC7B808EDED3202AF69B469228347F9 Filename: README.patch.5428 Algorithm #1 (sum -r): 38179 12 README.patch.5428 Algorithm #2 (sum): 47094 12 README.patch.5428 MD5 checksum: 3FEFF76F660E051E1EB255C85AD1C1B3 Filename: patchSG0005428 Algorithm #1 (sum -r): 30871 15 patchSG0005428 Algorithm #2 (sum): 1466 15 patchSG0005428 MD5 checksum: CBF7812F05D9672B398F729C848113C9 Filename: patchSG0005428.dev_man Algorithm #1 (sum -r): 28629 12 patchSG0005428.dev_man Algorithm #2 (sum): 65088 12 patchSG0005428.dev_man MD5 checksum: 76770F3C5AB120AF55F739DA42C99A40 Filename: patchSG0005428.dev_sw Algorithm #1 (sum -r): 02962 2967 patchSG0005428.dev_sw Algorithm #2 (sum): 51839 2967 patchSG0005428.dev_sw MD5 checksum: A365F6B280286B77B35B549752E1A0A9 Filename: patchSG0005428.eoe_man Algorithm #1 (sum -r): 10457 22 patchSG0005428.eoe_man Algorithm #2 (sum): 12877 22 patchSG0005428.eoe_man MD5 checksum: F724C951BAB9375863EE5927230BE2A6 Filename: patchSG0005428.eoe_sw Algorithm #1 (sum -r): 32009 15678 patchSG0005428.eoe_sw Algorithm #2 (sum): 45129 15678 patchSG0005428.eoe_sw MD5 checksum: 96B65981FD29693D294E97C6B60F4AA4 Filename: patchSG0005428.eoe_sw64 Algorithm #1 (sum -r): 17257 5934 patchSG0005428.eoe_sw64 Algorithm #2 (sum): 18922 5934 patchSG0005428.eoe_sw64 MD5 checksum: EF55732A4E1AD60F12C16BBF40D9D987 Filename: patchSG0005428.idb Algorithm #1 (sum -r): 21378 12 patchSG0005428.idb Algorithm #2 (sum): 6087 12 patchSG0005428.idb MD5 checksum: 4CB891C406029718F0B1DCF1A18BB352 Filename: patchSG0005428.irix_dev_sw Algorithm #1 (sum -r): 42515 20 patchSG0005428.irix_dev_sw Algorithm #2 (sum): 61566 20 patchSG0005428.irix_dev_sw MD5 checksum: 20307991B48867256113BBA4E5A36109 Filename: patchSG0005428.nfs_sw Algorithm #1 (sum -r): 29151 312 patchSG0005428.nfs_sw Algorithm #2 (sum): 61247 312 patchSG0005428.nfs_sw MD5 checksum: 80D8F5D446BCF0A7A63601EEE1F86A38 Filename: README.patch.5429 Algorithm #1 (sum -r): 65517 11 README.patch.5429 Algorithm #2 (sum): 30140 11 README.patch.5429 MD5 checksum: FCE5AFF54A8818A1BC43AAA90B3841A5 Filename: patchSG0005429 Algorithm #1 (sum -r): 64573 13 patchSG0005429 Algorithm #2 (sum): 55754 13 patchSG0005429 MD5 checksum: FD631DA9F7CB5A9D7CE784E886D23BE7 Filename: patchSG0005429.dev_man Algorithm #1 (sum -r): 28629 12 patchSG0005429.dev_man Algorithm #2 (sum): 65088 12 patchSG0005429.dev_man MD5 checksum: 76770F3C5AB120AF55F739DA42C99A40 Filename: patchSG0005429.dev_sw Algorithm #1 (sum -r): 14650 2910 patchSG0005429.dev_sw Algorithm #2 (sum): 50752 2910 patchSG0005429.dev_sw MD5 checksum: 94C08B781152EB925EACB2729B7EF8DC Filename: patchSG0005429.eoe_man Algorithm #1 (sum -r): 10457 22 patchSG0005429.eoe_man Algorithm #2 (sum): 12877 22 patchSG0005429.eoe_man MD5 checksum: F724C951BAB9375863EE5927230BE2A6 Filename: patchSG0005429.eoe_sw Algorithm #1 (sum -r): 30718 15497 patchSG0005429.eoe_sw Algorithm #2 (sum): 16913 15497 patchSG0005429.eoe_sw MD5 checksum: 3C8E0F6DFE4B3FF03FD1AB40B6723B91 Filename: patchSG0005429.eoe_sw64 Algorithm #1 (sum -r): 20340 5826 patchSG0005429.eoe_sw64 Algorithm #2 (sum): 28507 5826 patchSG0005429.eoe_sw64 MD5 checksum: 0627D3F3427358CFF093790CFE7915D3 Filename: patchSG0005429.idb Algorithm #1 (sum -r): 29898 11 patchSG0005429.idb Algorithm #2 (sum): 60700 11 patchSG0005429.idb MD5 checksum: B79B003164912BC59C81189211BC3235 Filename: patchSG0005429.irix_dev_sw Algorithm #1 (sum -r): 29446 15 patchSG0005429.irix_dev_sw Algorithm #2 (sum): 30495 15 patchSG0005429.irix_dev_sw MD5 checksum: 0A0118E17B525C4D059CD36C2BAB5590 Filename: patchSG0005429.nfs_sw Algorithm #1 (sum -r): 39301 312 patchSG0005429.nfs_sw Algorithm #2 (sum): 33469 312 patchSG0005429.nfs_sw MD5 checksum: 2D396ACDFE42E5F00A44625373AA9380 - ------------- - --- Links --- - ------------- Patches are available via the web, anonymous FTP and from your SGI service/support provider. SGI Security Advisories can be found at: http://www.sgi.com/support/security/ and ftp://patches.sgi.com/support/free/security/advisories/ SGI Security Patches can be found at: http://www.sgi.com/support/security/ and ftp://patches.sgi.com/support/free/security/patches/ SGI patches for IRIX can be found at the following patch servers: http://support.sgi.com/ and ftp://patches.sgi.com/ SGI freeware updates for IRIX can be found at: http://freeware.sgi.com/ SGI fixes for SGI open sourced code can be found on: http://oss.sgi.com/projects/ SGI patches and RPMs for Linux can be found at: http://support.sgi.com/ SGI patches for Windows NT or 2000 can be found at: http://support.sgi.com/ IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at: http://support.sgi.com/ IRIX 6.5 Maintenance Release Streams can be found at: http://support.sgi.com/ IRIX 6.5 Software Update CDs can be obtained from: http://support.sgi.com/ The primary SGI anonymous FTP site for security advisories and patches is patches.sgi.com (216.32.174.211). Security advisories and patches are located under the URL ftp://patches.sgi.com/support/free/security/ - ------------------------ - --- Acknowledgments ---- - ------------------------ SGI wishes to thank the users of the Internet Community at large for their assistance in this matter. - ----------------------------------------- - --- SGI Security Information/Contacts --- - ----------------------------------------- If there are questions about this document, email can be sent to security-info@sgi.com. ------oOo------ SGI provides security information and patches for use by the entire SGI community. This information is freely available to any person needing the information and is available via anonymous FTP and the Web. The primary SGI anonymous FTP site for security advisories and patches is patches.sgi.com (216.32.174.211). Security advisories and patches are located under the URL ftp://patches.sgi.com/support/free/security/ The SGI Security Headquarters Web page is accessible at the URL: http://www.sgi.com/support/security/ For issues with the patches on the FTP sites, email can be sent to security-info@sgi.com. For assistance obtaining or working with security patches, please contact your SGI support provider. ------oOo------ SGI provides a free security mailing list service called wiretap and encourages interested parties to self-subscribe to receive (via email) all SGI Security Advisories when they are released. Subscribing to the mailing list can be done via the Web (http://www.sgi.com/support/security/wiretap.html) or by sending email to SGI as outlined below. % mail wiretap-request@sgi.com subscribe wiretap end ^d In the example above, is the email address that you wish the mailing list information sent to. The word end must be on a separate line to indicate the end of the body of the message. The control-d (^d) is used to indicate to the mail program that you are finished composing the mail message. ------oOo------ SGI provides a comprehensive customer World Wide Web site. This site is located at http://www.sgi.com/support/security/ . ------oOo------ If there are general security questions on SGI systems, email can be sent to security-info@sgi.com. For reporting *NEW* SGI security issues, email can be sent to security-alert@sgi.com or contact your SGI support provider. A support contract is not required for submitting a security report. ______________________________________________________________________________ This information is provided freely to all interested parties and may be redistributed provided that it is not altered in any way, SGI is appropriately credited and the document retains and includes its valid PGP signature. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBP9EKL7Q4cFApAP75AQFnuQQAh9Vy/9znC9OHWQAylIK3hyVqZtvThO4n RpYV5fUEHAw+a2Ujmk8IFKzQreAWTux+Jen0EcvHcXl3zcWQ7hV4vMFTNvizxYGR jIbAWtBI3P7OGmiLt2jmDXICDZ6FMrOu6wrMspPCoUFAYFcuJUc3oBQC5oDzBIy+ C4yycT1JBa4= =UHTk -----END PGP SIGNATURE-----