Note: This is an archival copy of Security Sun Alert 240866 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019543.1.
Solaris 10 Operating System
Date of Resolved Release
Security Vulnerability in Solaris 10 NFS Remote Procedure Calls (RPCs):
A security vulnerability in the NFS Remote Procedure Calls (RPC) zones implementation may allow a local user with administrative privileges in a non-global zone to intercept and corrupt NFS traffic destined for other non-global zones on the system. This may result in a Denial of Service (DoS) to the NFS services in the affected non-global zones.
Sun acknowledges with thanks, Hewitt Associates for bringing this issue to our attention.
2. Contributing Factors
This issue can occur in the following releases:
Note 2: Non-global zones which use Secure NFS (using either Diffie-Hellman authentication or Kerberos V5 authentication which uses RPCSEC_GSS) are not impacted by this issue.
Note 3: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived.
To determine the base build of OpenSolaris, the following command can be used:
$ uname -v
To determine if a system has a Package Repository Update (PRU) installed which addresses this issue, execute the following command:
$ pkg contents -o name,value -t set | grep 66552513. Symptoms
If the described issue has been exploited to cause a Denial of Service, RPC requests from inside non-global zones may fail unpexpectedly. Failed RPC requests would cause NFS requests to the NFS server to be retried or to fail. This would be seen by longer access times for NFS files and/or errors when accessing files shared by NFS. There are no predictable symptoms that would indicate that this issue has been exploited to present incorrect data to NFS clients who make NFS requests to the server.
To workaround this issue, non-global zones can be configured to use Secure NFS using either Diffie-Hellman authentication or Kerberos V5 authentication which uses RPCSEC_GSS. Consult the following documentation for more information about configuring Kerberos for NFS/RPC:
This issue is addressed in the following releases:
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment