From owner-freebsd-security@FreeBSD.ORG Wed Mar 1 15:01:12 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 81FC616A423; Wed, 1 Mar 2006 15:01:12 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9AE2A43D4C; Wed, 1 Mar 2006 15:01:11 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (simon@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k21F1B3j062150; Wed, 1 Mar 2006 15:01:11 GMT (envelope-from security-advisories@freebsd.org) Received: (from simon@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k21F1Btv062148; Wed, 1 Mar 2006 15:01:11 GMT (envelope-from security-advisories@freebsd.org) Date: Wed, 1 Mar 2006 15:01:11 GMT Message-Id: <200603011501.k21F1Btv062148@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: simon set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Cc: Subject: FreeBSD Security Advisory FreeBSD-SA-06:09.openssh X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: security-advisories@freebsd.org List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2006 15:01:12 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:09.openssh Security Advisory The FreeBSD Project Topic: Remote denial of service in OpenSSH Category: contrib Module: OpenSSH Announced: 2006-03-01 Affects: FreeBSD 5.3 and 5.4 Corrected: 2006-03-01 14:19:48 UTC (RELENG_5, 5.5-PRERELEASE) 2006-03-01 14:21:01 UTC (RELENG_5_4, 5.4-RELEASE-p12) 2006-03-01 14:24:52 UTC (RELENG_5_3, 5.3-RELEASE-p27) CVE Name: CVE-2006-0883 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background OpenSSH is an implementation of the SSH protocol suite, providing an encrypted, authenticated transport for a variety of services, including remote shell access. Privilege separation is a mechanism used by OpenSSH to protect itself against possible future vulnerabilities. It works by splitting the server process in two: the child process drops its privileges and carries on the conversation with the client, while the parent retains its privileges, monitors the child, and performs privileged operations on behalf of the child when it is satisified that everything is in order. Privilege separation is enabled by default in FreeBSD. OpenPAM is an implementation of the PAM framework, which allows the use of loadable modules to implement user authentication and session management in a manner defined by the administrator. It is used by OpenSSH and numerous other applications in FreeBSD to provide a consistent and configurable authentication system. II. Problem Description Because OpenSSH and OpenPAM have conflicting designs (one is event- driven while the other is callback-driven), it is necessary for OpenSSH to fork a child process to handle calls to the PAM framework. However, if the unprivileged child terminates while PAM authentication is under way, the parent process incorrectly believes that the PAM child also terminated. The parent process then terminates, and the PAM child is left behind. Due to the way OpenSSH performs internal accounting, these orphaned PAM children are counted as pending connections by the master OpenSSH server process. Once a certain number of orphans has accumulated, the master decides that it is overloaded and stops accepting client connections. III. Impact By repeatedly connecting to a vulnerable server, waiting for a password prompt, and closing the connection, an attacker can cause OpenSSH to stop accepting client connections until the system restarts or an administrator manually kills the orphaned PAM processes. IV. Workaround The following command will show a list of orphaned PAM processes: # pgrep -lf '\[pam\]' The following command will kill orphaned PAM processes: # pkill -f '\[pam\]' To prevent OpenSSH from leaving orphaned PAM processes behind, perform one of the following: 1) Disable PAM authentication in OpenSSH. Users will still be able to log in using their Unix password, OPIE or SSH keys. To do this, execute the following commands as root: # echo 'UsePAM no' >>/etc/ssh/sshd_config # /etc/rc.d/sshd restart 2) If disabling PAM is not an option - if, for instance, you use RADIUS authentication, or store user passwords in an SQL database - you may instead disable privilege separation. However, this may leave OpenSSH vulnerable to hitherto unknown bugs, and should be considered a last resort. To do this, execute the following commands as root: # echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config # /etc/rc.d/sshd restart V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 5-STABLE or to the RELENG_5_4 or RELENG_5_3 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 5.3 and 5.4 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/secure/lib/libssh # make obj && make depend && make && make install # cd /usr/src/secure/usr.sbin/sshd # make obj && make depend && make && make install # /etc/rc.d/sshd restart VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_5 src/crypto/openssh/auth-pam.c 1.14.2.1 src/crypto/openssh/ssh_config 1.25.2.1 src/crypto/openssh/ssh_config.5 1.15.2.1 src/crypto/openssh/sshd_config 1.40.2.1 src/crypto/openssh/sshd_config.5 1.21.2.1 src/crypto/openssh/version.h 1.27.2.1 RELENG_5_4 src/UPDATING 1.342.2.24.2.21 src/sys/conf/newvers.sh 1.62.2.18.2.17 src/crypto/openssh/auth-pam.c 1.14.6.1 src/crypto/openssh/ssh_config 1.25.6.1 src/crypto/openssh/ssh_config.5 1.15.6.1 src/crypto/openssh/sshd_config 1.40.6.1 src/crypto/openssh/sshd_config.5 1.21.6.1 src/crypto/openssh/version.h 1.27.6.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.30 src/sys/conf/newvers.sh 1.62.2.15.2.32 src/crypto/openssh/auth-pam.c 1.14.4.1 src/crypto/openssh/ssh_config 1.25.4.1 src/crypto/openssh/ssh_config.5 1.15.4.1 src/crypto/openssh/sshd_config 1.40.4.1 src/crypto/openssh/sshd_config.5 1.21.4.1 src/crypto/openssh/version.h 1.27.4.1 - ------------------------------------------------------------------------- VII. References http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248125 http://bugzilla.mindrot.org/show_bug.cgi?id=839 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0883 The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) iD8DBQFEBbOEFdaIBMps37IRAghrAJ93wcvG5uGATpA8jDIQE0Dn8fF8iQCglz6r DaXFHxKA7Xhc33smtuMlWNU= =87jf -----END PGP SIGNATURE----- From owner-freebsd-security@FreeBSD.ORG Wed Mar 1 15:02:09 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 390D016A420; Wed, 1 Mar 2006 15:02:09 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8655243D62; Wed, 1 Mar 2006 15:02:06 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (simon@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k21F26HZ062430; Wed, 1 Mar 2006 15:02:06 GMT (envelope-from security-advisories@freebsd.org) Received: (from simon@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k21F26v5062428; Wed, 1 Mar 2006 15:02:06 GMT (envelope-from security-advisories@freebsd.org) Date: Wed, 1 Mar 2006 15:02:06 GMT Message-Id: <200603011502.k21F26v5062428@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: simon set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Cc: Subject: FreeBSD Security Advisory FreeBSD-SA-06:10.nfs X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: security-advisories@freebsd.org List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2006 15:02:09 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:10.nfs Security Advisory The FreeBSD Project Topic: Remote denial of service in NFS server Category: core Module: sys_nfsserver Announced: 2006-03-01 Credits: Evgeny Legerov Affects: All FreeBSD releases. Corrected: 2006-03-01 14:18:11 UTC (RELENG_6, 6.1-PRERELEASE) 2006-03-01 14:18:46 UTC (RELENG_6_0, 6.0-RELEASE-p5) 2006-03-01 14:19:48 UTC (RELENG_5, 5.5-PRERELEASE) 2006-03-01 14:21:01 UTC (RELENG_5_4, 5.4-RELEASE-p12) 2006-03-01 14:24:52 UTC (RELENG_5_3, 5.3-RELEASE-p27) 2006-03-01 14:21:56 UTC (RELENG_4, 4.11-STABLE) 2006-03-01 14:22:30 UTC (RELENG_4_11, 4.11-RELEASE-p15) 2006-03-01 14:23:07 UTC (RELENG_4_10, 4.10-RELEASE-p21) CVE Name: CVE-2006-0900 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background The Network File System (NFS) allows a host to export some or all of its filesystems so that other hosts can access them over the network and mount them as if they were on local disks. NFS is built on top of the Sun Remote Procedure Call (RPC) framework. II. Problem Description A part of the NFS server code charged with handling incoming RPC messages via TCP had an error which, when the server received a message with a zero-length payload, would cause a NULL pointer dereference which results in a kernel panic. The kernel will only process the RPC messages if a userland nfsd daemon is running. III. Impact The NULL pointer deference allows a remote attacker capable of sending RPC messages to an affected FreeBSD system to crash the FreeBSD system. IV. Workaround 1) Disable the NFS server: set the nfs_server_enable variable to "NO" in /etc/rc.conf, and reboot. Alternatively, if there are no active NFS clients (as listed by the showmount(8) utility), simply killing the mountd and nfsd processes should suffice. 2) Add firewall rules to block RPC traffic to the NFS server from untrusted hosts. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 4-STABLE, 5-STABLE, or 6-STABLE, or to the RELENG_6_0, RELENG_5_4, RELENG_5_3, RELENG_4_11, or RELENG_4_10 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 4.10, 4.11, 5.3, 5.4, and 6.0 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 4.x] # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:10/nfs4.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:10/nfs4.patch.asc [FreeBSD 5.x and 6.x] # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:10/nfs.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:10/nfs.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_4 src/sys/nfs/nfs_socket.c 1.60.2.7 RELENG_4_11 src/UPDATING 1.73.2.91.2.16 src/sys/conf/newvers.sh 1.44.2.39.2.19 src/sys/nfs/nfs_socket.c 1.60.2.6.6.1 RELENG_4_10 src/UPDATING 1.73.2.90.2.22 src/sys/conf/newvers.sh 1.44.2.34.2.23 src/sys/nfs/nfs_socket.c 1.60.2.6.4.1 RELENG_5 src/sys/nfsserver/nfs_srvsock.c 1.92.2.2 RELENG_5_4 src/UPDATING 1.342.2.24.2.21 src/sys/conf/newvers.sh 1.62.2.18.2.17 src/sys/nfsserver/nfs_srvsock.c 1.92.2.1.2.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.30 src/sys/conf/newvers.sh 1.62.2.15.2.32 src/sys/nfsserver/nfs_srvsock.c 1.92.4.1 RELENG_6 src/sys/nfsserver/nfs_srvsock.c 1.94.2.1 RELENG_6_0 src/UPDATING 1.416.2.3.2.10 src/sys/conf/newvers.sh 1.69.2.8.2.6 src/sys/nfsserver/nfs_srvsock.c 1.94.4.1 - ------------------------------------------------------------------------- VII. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0900 The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:10.nfs.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) iD8DBQFEBbOIFdaIBMps37IRAgmUAJ0fYEjr1gk8KpHGbcmhpPwh+GqI3ACcDH5X dN3ngWsO1Z91GdTjJe0e7VE= =GCDX -----END PGP SIGNATURE----- From owner-freebsd-security@FreeBSD.ORG Wed Mar 1 16:06:17 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8DC2016A422; Wed, 1 Mar 2006 16:06:17 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id A9B4543D66; Wed, 1 Mar 2006 16:06:13 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (simon@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k21G6DFi066887; Wed, 1 Mar 2006 16:06:13 GMT (envelope-from security-advisories@freebsd.org) Received: (from simon@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k21G6Dm4066885; Wed, 1 Mar 2006 16:06:13 GMT (envelope-from security-advisories@freebsd.org) Date: Wed, 1 Mar 2006 16:06:13 GMT Message-Id: <200603011606.k21G6Dm4066885@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: simon set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Cc: Subject: FreeBSD Security Advisory FreeBSD-SA-06:09.openssh [REVISED] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: security-advisories@freebsd.org List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2006 16:06:17 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:09.openssh Security Advisory The FreeBSD Project Topic: Remote denial of service in OpenSSH Category: contrib Module: OpenSSH Announced: 2006-03-01 Affects: FreeBSD 5.3 and 5.4 Corrected: 2006-03-01 14:19:48 UTC (RELENG_5, 5.5-PRERELEASE) 2006-03-01 14:21:01 UTC (RELENG_5_4, 5.4-RELEASE-p12) 2006-03-01 14:24:52 UTC (RELENG_5_3, 5.3-RELEASE-p27) CVE Name: CVE-2006-0883 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . 0. Revision History v1.0 2006-03-01 Initial release. v1.1 2006-03-01 Corrected workaround instructions. I. Background OpenSSH is an implementation of the SSH protocol suite, providing an encrypted, authenticated transport for a variety of services, including remote shell access. Privilege separation is a mechanism used by OpenSSH to protect itself against possible future vulnerabilities. It works by splitting the server process in two: the child process drops its privileges and carries on the conversation with the client, while the parent retains its privileges, monitors the child, and performs privileged operations on behalf of the child when it is satisified that everything is in order. Privilege separation is enabled by default in FreeBSD. OpenPAM is an implementation of the PAM framework, which allows the use of loadable modules to implement user authentication and session management in a manner defined by the administrator. It is used by OpenSSH and numerous other applications in FreeBSD to provide a consistent and configurable authentication system. II. Problem Description Because OpenSSH and OpenPAM have conflicting designs (one is event- driven while the other is callback-driven), it is necessary for OpenSSH to fork a child process to handle calls to the PAM framework. However, if the unprivileged child terminates while PAM authentication is under way, the parent process incorrectly believes that the PAM child also terminated. The parent process then terminates, and the PAM child is left behind. Due to the way OpenSSH performs internal accounting, these orphaned PAM children are counted as pending connections by the master OpenSSH server process. Once a certain number of orphans has accumulated, the master decides that it is overloaded and stops accepting client connections. III. Impact By repeatedly connecting to a vulnerable server, waiting for a password prompt, and closing the connection, an attacker can cause OpenSSH to stop accepting client connections until the system restarts or an administrator manually kills the orphaned PAM processes. IV. Workaround The following command will show a list of orphaned PAM processes: # pgrep -lf 'sshd.*\[pam\]' The following command will kill orphaned PAM processes: # pkill -f 'sshd.*\[pam\]' To prevent OpenSSH from leaving orphaned PAM processes behind, perform one of the following: 1) Disable PAM authentication in OpenSSH. Users will still be able to log in using their Unix password, OPIE or SSH keys. To do this, execute the following commands as root: # echo 'UsePAM no' >>/etc/ssh/sshd_config # /etc/rc.d/sshd restart 2) If disabling PAM is not an option - if, for instance, you use RADIUS authentication, or store user passwords in an SQL database - you may instead disable privilege separation. However, this may leave OpenSSH vulnerable to hitherto unknown bugs, and should be considered a last resort. To do this, execute the following commands as root: # echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config # /etc/rc.d/sshd restart V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 5-STABLE or to the RELENG_5_4 or RELENG_5_3 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 5.3 and 5.4 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/secure/lib/libssh # make obj && make depend && make && make install # cd /usr/src/secure/usr.sbin/sshd # make obj && make depend && make && make install # /etc/rc.d/sshd restart VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_5 src/crypto/openssh/auth-pam.c 1.14.2.1 src/crypto/openssh/ssh_config 1.25.2.1 src/crypto/openssh/ssh_config.5 1.15.2.1 src/crypto/openssh/sshd_config 1.40.2.1 src/crypto/openssh/sshd_config.5 1.21.2.1 src/crypto/openssh/version.h 1.27.2.1 RELENG_5_4 src/UPDATING 1.342.2.24.2.21 src/sys/conf/newvers.sh 1.62.2.18.2.17 src/crypto/openssh/auth-pam.c 1.14.6.1 src/crypto/openssh/ssh_config 1.25.6.1 src/crypto/openssh/ssh_config.5 1.15.6.1 src/crypto/openssh/sshd_config 1.40.6.1 src/crypto/openssh/sshd_config.5 1.21.6.1 src/crypto/openssh/version.h 1.27.6.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.30 src/sys/conf/newvers.sh 1.62.2.15.2.32 src/crypto/openssh/auth-pam.c 1.14.4.1 src/crypto/openssh/ssh_config 1.25.4.1 src/crypto/openssh/ssh_config.5 1.15.4.1 src/crypto/openssh/sshd_config 1.40.4.1 src/crypto/openssh/sshd_config.5 1.21.4.1 src/crypto/openssh/version.h 1.27.4.1 - ------------------------------------------------------------------------- VII. References http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248125 http://bugzilla.mindrot.org/show_bug.cgi?id=839 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0883 The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) iD8DBQFEBcVoFdaIBMps37IRAtciAJ0ZEisuqx4lAtn2vr+44e4mrWYQuQCeLLRB kUuFQBE4Jy3SJeI+07wnknA= =esdm -----END PGP SIGNATURE----- From owner-freebsd-security@FreeBSD.ORG Wed Mar 1 16:18:41 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 87C9116A420 for ; Wed, 1 Mar 2006 16:18:41 +0000 (GMT) (envelope-from cperciva@freebsd.org) Received: from pd5mo2so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id A995E43D8A for ; Wed, 1 Mar 2006 16:18:40 +0000 (GMT) (envelope-from cperciva@freebsd.org) Received: from pd3mr8so.prod.shaw.ca (pd3mr8so-qfe3.prod.shaw.ca [10.0.141.24]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IVG009XJIN34MC0@l-daemon> for freebsd-security@freebsd.org; Wed, 01 Mar 2006 09:18:39 -0700 (MST) Received: from pn2ml7so.prod.shaw.ca ([10.0.121.151]) by pd3mr8so.prod.shaw.ca (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IVG00JSEIN3YC40@pd3mr8so.prod.shaw.ca> for freebsd-security@freebsd.org; Wed, 01 Mar 2006 09:18:39 -0700 (MST) Received: from [192.168.0.60] ([24.82.18.31]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IVG005WAIN28NW0@l-daemon> for freebsd-security@freebsd.org; Wed, 01 Mar 2006 09:18:39 -0700 (MST) Date: Wed, 01 Mar 2006 08:18:27 -0800 From: Colin Percival In-reply-to: <200603011502.k21F26v5062428@freefall.freebsd.org> To: freebsd-security@freebsd.org Message-id: <4405C953.80005@freebsd.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Enigmail-Version: 0.94.0.0 References: <200603011502.k21F26v5062428@freefall.freebsd.org> User-Agent: Thunderbird 1.5 (X11/20060112) Subject: Re: FreeBSD Security Advisory FreeBSD-SA-06:10.nfs X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2006 16:18:41 -0000 FreeBSD Security Advisories wrote: > Topic: Remote denial of service in NFS server > [...] > IV. Workaround > > 1) Disable the NFS server: set the nfs_server_enable variable to "NO" > in /etc/rc.conf, and reboot. > > Alternatively, if there are no active NFS clients (as listed by the > showmount(8) utility), simply killing the mountd and nfsd processes > should suffice. > > 2) Add firewall rules to block RPC traffic to the NFS server from > untrusted hosts. There's one more workaround: Since this problem only affects RPC messages incoming via TCP, disabling the use of TCP with NFS will correct this while still allowing NFS to run over UDP. To disable use of TCP for NFS, remove the "-t" flag from nfs_server_flags in /etc/rc.conf and reboot. Colin Percival