Subject: NFS/pormapper security bug and fix (Linux)
From: [email-masked] (Thomas Koenig)
Date: Thu, 1 Sep 1994 16:26:54 GMT
Newsgroups: comp.os.linux.announce,comp.security.unix,comp.os.linux.admin,de.comp.os.linux

There is a security bug in Linux NFS implementations.

This problem lets any user on the Internet gain access to file systems
which can be mounted on the local host.  Apparently (from discussions
on comp.security.unix) it is being actively exploited.

There are two possible fixes to this problem:

- Install a fixed portmapper, which is now available from sunsite.unc.edu,
  and mirrors.  For the LSM, see below.

- As an emergency fix, make sure that it's impossible to mount the NFS
  exported directories locally; you'll need to edit /etc/exports for
  this. Try

# mount localhost:/exported/directory /mnt

and

# mount yourhostname:/exported/directory /mnt

to see wether you're vulnerable.  For secrity purposes, it is best
to restrict exporting NFS filesystems to exactly specified hosts
you trust, even if it's readonly.

Also note that there's a bug in all libc versions up to 4.5.26 (at
least) which throws the portmapper into a forking loop under some
conditions.  To avoid this, you'll need to use one of the newer kernels
with the CONFIG_I_AM_A_BROKEN_BSD_WEENIE option, or apply the (binary)
patch to libc 4.5.  26 contained in portmap_3_rpcfix.shar.gz (to be
found in sunsite's Incoming).

Begin3
Title:          portmap
Version:        3
Entered-date:   1994-08-31
Description:    This is a replacement portmap to fix some security holes
                in the original protocol.  Don't install any of the "old"
                portmap versions.  It also features access control to
                the portmapper via /etc/hosts.allow and /etc/hosts.deny.
                The *shar files contain source; apply portmap_3.patch
                and compile.  You'll also need the libwrap.a from the
                tcp_wrappers package.
                To install the binaries, for which you need libc >= 4.5.26,
                copy portmap_3_bin.tar.gz to /tmp, then do (as root)
                # cd /
                # gzip -c -d /tmp/portmap_3_bin.tar.gz
Keywords:       NFS portmap security patch
Author:         Wietse Venema ([email-masked])
Maintained-by:  Thomas Koenig ([email-masked])
Primary-site:   sunsite.unc.edu /pub/Linux/network/daemons/
			24604	portmap_3_bin.tar.gz
                        30737   portmap_3.shar.Z
                         1738   portmap_3.BLURB
			 1932   portmap_3.lsm
		       103443   tcp_wrappers_6.3.shar.Z
                         1230   portmap_3.patch
		         2528   portmap_3_rpcfix.shar.gz
Alternate-site: tsx-11.mit.edu  /pub/linux/sources/sbin
			24604   /pub/linux/binaries/sbin/portmap_3_bin.tar.gz
                        30737   portmap_3.shar.Z
                         1738   portmap_3.BLURB
                         1932   portmap_3.lsm
                       103443   tcp_wrappers_6.3.shar.Z
                         1230   pormtap_3.patch
		         2528   portmap_3_rpcfix.shar.gz
Original-site:  ftp.win.tue.nl /pub/security/
                        1738    portmap_3.BLURB
                       30373    portmap_3.shar.Z
                      103443    tcp_wrappers_6.3.shar.Z
Platform:        Linux
Copying-policy:  BSD-Style
End
--
Thomas Koenig, [email-masked], [email-masked].
The joy of engineering is to find a straight line on a double
logarithmic diagram.

--
Send submissions for comp.os.linux.announce to: [email-masked]
Be sure to include Keywords: and a short description of your software.