Archive of FreeBSD Security general posting, FreeBSD Security Advisory FreeBSD-SA-02:36.nfs

06/08/02, FreeBSD Security Advisory FreeBSD-SA-02:36.nfs
From: FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>

Generated by MHonArc

CSIM Logo WelcomeCourses
Faculty, Student, Staff
Projects and reports
Conferences, workshop and seminars
Laboratories and reasearch facilities
Information related to CSIM
Information non-related to CSIM
Address, map, phone, etc.

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

To: FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>
Subject: FreeBSD Security Advisory FreeBSD-SA-02:36.nfs
From: FreeBSD Security Advisories <security-advisories@FreeBSD.ORG>
Date: Mon, 5 Aug 2002 16:51:06 -0700 (PDT)
List-archive: <> (Web Archive)
List-help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-id: <freebsd-security-notifications.FreeBSD.ORG>
List-subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security-notifications>
List-unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security-notifications>
Reply-to: postmaster@FreeBSD.ORG
Sender: owner-freebsd-security-notifications@FreeBSD.ORG


FreeBSD-SA-02:36.nfs                                        Security Advisory
                                                          The FreeBSD Project

Topic:          Bug in NFS server code allows remote denial of service

Category:       core
Module:         nfs
Announced:      2002-08-05
Credits:        Mike Junk <>
Affects:        All releases prior to 4.6.1-RELEASE-p7
                4.6-STABLE prior to the correction date
Corrected:      2002-07-19 17:19:53 UTC (RELENG_4)
                2002-08-01 19:31:55 UTC (RELENG_4_6)
                2002-08-01 19:31:54 UTC (RELENG_4_5)
                2002-08-01 19:31:54 UTC (RELENG_4_4)
FreeBSD only:   NO

I.   Background

The Network File System (NFS) allows a host to export some or all of
its filesystems, or parts of them, so that other hosts can access them
over the network and mount them as if they were on local disks.  NFS is
built on top of the Sun Remote Procedure Call (RPC) framework.

II.  Problem Description

A part of the NFS server code charged with handling incoming RPC
messages had an error which, when the server received a message with a
zero-length payload, would cause it to reference the payload from the
previous message, creating a loop in the message chain.  This would
later cause an infinite loop in a different part of the NFS server
code which tried to traverse the chain.

III. Impact

Certain Linux implementations of NFS produce zero-length RPC messages
in some cases.  A FreeBSD system running an NFS server may lock up
when such clients connect.

An attacker in a position to send RPC messages to an affected FreeBSD
system can construct a sequence of malicious RPC messages that cause
the target system to lock up.

IV.  Workaround

1) Disable the NFS server: set the nfs_server_enable variable to "NO"
   in /etc/rc.conf, and reboot.

   Alternatively, if there are no active NFS clients (as listed by the
   showmount(8) utility), just killing the mountd and nfsd processes
   should suffice.

2) Add firewall rules to block RPC traffic to the NFS server from
   untrusted hosts.

V.   Solution

The following patch has been verified to apply to FreeBSD 4.4, 4.5, and
4.6 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch
# fetch

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel and modules as described in
<URL:> and reboot the

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Path                                                             Revision
- -------------------------------------------------------------------------
- -------------------------------------------------------------------------
Version: GnuPG v1.0.7 (FreeBSD)


To Unsubscribe: send mail to
with "unsubscribe freebsd-security-notifications" in the body of the message

Previous message sorted by date: FreeBSD Security Advisory FreeBSD-SA-02:35.ffs
Next message sorted by date: FreeBSD Security Advisory FreeBSD-SA-02:37.kqueue
Previous message sorted by thread: FreeBSD Security Advisory FreeBSD-SA-02:35.ffs
Next message by thread: FreeBSD Security Advisory FreeBSD-SA-02:37.kqueue
Main Index
Thread Index

CSIM home pageWMailAccount managementCSIM LibraryNetwork test toolsSearch CSIM directories
Contact us: Olivier Nicole CSIM    SET    AIT Last update: Jan 2003