-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



CERT Advisory CA-99-05 Vulnerability in statd exposes vulnerability in

automountd



   Original issue date: June 9, 1999

   Source: CERT/CC

   Revised Date: July 22, 1999

   Added link to IN-99-04 in the "Description" section.

   

Systems Affected



   Systems running older versions of rpc.statd and automountd

   

I. Description



   This advisory describes two vulnerabilities that are being used

   together by intruders to gain access to vulnerable systems. The first

   vulnerability is in rpc.statd, a program used to communicate state

   changes among NFS clients and servers. The second vulnerability is in

   automountd, a program used to automatically mount certain types of

   file systems. Both of these vulnerabilities have been widely discussed

   on public forums, such as BugTraq, and some vendors have issued

   security advisories related to the problems discussed here. Because of

   the number of incident reports we have received, however, we are

   releasing this advisory to call attention to these problems so that

   system and network administrators who have not addressed these

   problems do so immediately. For more information about attacks using

   various RPC services please see CERT® Incident Note IN-99-04

   http://www.cert.org/incident_notes/IN-99-04.html

   

   The vulnerability in rpc.statd allows an intruder to call arbitrary

   rpc services with the privileges of the rpc.statd process. The called

   rpc service may be a local service on the same machine or it may be a

   network service on another machine. Although the form of the call is

   constrained by rpc.statd, if the call is acceptable to another rpc

   service, the other rpc service will act on the call as if it were an

   authentic call from the rpc.statd process.

   

   The vulnerability in automountd allows a local intruder to execute

   arbitrary commands with the privileges of the automountd process. This

   vulnerability has been widely known for a significant period of time,

   and patches have been available from vendors, but many systems remain

   vulnerable because their administrators have not yet applied the

   appropriate patches.

   

   By exploiting these two vulnerabilities simultaneously, a remote

   intruder is able to "bounce" rpc calls from the rpc.statd service to

   the automountd service on the same targeted machine. Although on many

   systems the automountd service does not normally accept traffic from

   the network, this combination of vulnerabilities allows a remote

   intruder to execute arbitrary commands with the administrative

   privileges of the automountd service, typically root.

   

   Note that the rpc.statd vulnerability described in this advisory is

   distinct from the vulnerabilities described in CERT Advisories

   CA-96.09 and CA-97.26.

   

II. Impact



   The vulnerability in rpc.statd may allow a remote intruder to call

   arbitrary rpc services with the privileges of the rpc.statd process,

   typically root. The vulnerablility in automountd may allow a local

   intruder to execute arbitrary commands with the privileges of the

   automountd service.

   

   By combining attacks exploiting these two vulnerabilities, a remote

   intruder is able to execute arbitrary commands with the privileges of

   the automountd service.

   

Note



   It may still be possible to cause rpc.statd to call other rpc services

   even after applying patches which reduce the privileges of rpc.statd.

   If there are additional vulnerabilities in other rpc services

   (including services you have written), an intruder may be able to

   exploit those vulnerabilities through rpc.statd. At the present time,

   we are unaware of any such vulnerabilitity that may be exploited

   through this mechanism.

   

III. Solutions



   Install a patch from your vendor

   

   Appendix A contains input from vendors who have provided information

   for this advisory. We will update the appendix as we receive more

   information. If you do not see your vendor's name, the CERT/CC did not

   hear from that vendor. Please contact your vendor directly.

   

Appendix A: Vendor Information



   Caldera

   

   Caldera's currently not shipping statd.

          

   Compaq Computer Corporation

   

        (c) Copyright 1998, 1999 Compaq Computer Corporation. All rights

                reserved.

                SOURCE: Compaq Computer Corporation

                Compaq Services

                Software Security Response Team USA

                This reported problem has not been found to affect the as

                shipped, Compaq's Tru64/UNIX Operating Systems Software.

                - Compaq Computer Corporation

                

          Data General

          

        We are investigating. We will provide an update when our

                investigation is complete.

                

          Hewlett-Packard Company

          

        HP is not vulnerable.

                

          The Santa Cruz Operation, Inc.

          

        No SCO products are vulnerable.

                

          Silicon Graphics, Inc.

          

        % IRIX

                

              % rpc.statd

                      IRIX 6.2 and above ARE NOT vulnerable.

                      IRIX 5.3 is vulnerable, but no longer supported.

                      % automountd

                      With patches from SGI Security Advisory

                      19981005-01-PX installed,

                      IRIX 6.2 and above ARE NOT vulnerable.

                      

                % Unicos

                

              Currently, SGI is investigating and no further information

                      is

                      available for public release at this time.

                      

                As further information becomes available, additional

                advisories

                will be issued via the normal SGI security information

                distribution

                method including the wiretap mailing list.

                SGI Security Headquarters

                http://www.sgi.com/Support/security

                

          Sun Microsystems Inc.

          

        The following patches are available:

                rpc.statd:

                Patch OS Version

                _____ __________

                106592-02 SunOS 5.6

                106593-02 SunOS 5.6_x86

                104166-04 SunOS 5.5.1

                104167-04 SunOS 5.5.1_x86

                103468-04 SunOS 5.5

                103469-05 SunOS 5.5_x86

                102769-07 SunOS 5.4

                102770-07 SunOS 5.4_x86

                102932-05 SunOS 5.3

                The fix for this vulnerability was integrated in SunOS

                5.7 (Solaris 7) before it was released.

                automountd:

                104654-05 SunOS 5.5.1

                104655-05 SunOS 5.5.1_x86

                103187-43 SunOS 5.5

                103188-43 SunOS 5.5_x86

                101945-61 SunOS 5.4

                101946-54 SunOS 5.4_x86

                101318-92 SunOS 5.3

                SunOS 5.6 (Solaris 2.6) and SunOS 5.7 (Solaris 7) are not

                vulnerable.

                Sun security patches are available at:

                

          http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-li

          cense&nav=pub-patches

          _______________________________________________________________

          

          Our thanks to Olaf Kirch of Caldera for his assistance in

          helping us understand the problem and Chok Poh of Sun

          Microsystems for his assistance in helping us construct this

          advisory.

          _______________________________________________________________

          

          This document is available from:

          http://www.cert.org/advisories/CA-99-05-statd-automountd.html.

          _______________________________________________________________

          

CERT/CC Contact Information



        Email: cert@cert.org

                Phone: +1 412-268-7090 (24-hour hotline)

                Fax: +1 412-268-6989

                Postal address:

                CERT Coordination Center

                Software Engineering Institute

                Carnegie Mellon University

                Pittsburgh PA 15213-3890

                U.S.A.

                

          CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) /

          EDT(GMT-4) Monday through Friday; they are on call for

          emergencies during other hours, on U.S. holidays, and on

          weekends.

          

Using encryption



          We strongly urge you to encrypt sensitive information sent by

          email. Our public PGP key is available from

          http://www.cert.org/CERT_PGP.key. If you prefer to use DES,

          please call the CERT hotline for more information.

          

Getting security information



          CERT publications and other security information are available

          from our web site http://www.cert.org/.

          

          To be added to our mailing list for advisories and bulletins,

          send email to cert-advisory-request@cert.org and include

          SUBSCRIBE your-email-address in the subject of your message.

          

          Copyright 1999 Carnegie Mellon University.

          Conditions for use, disclaimers, and sponsorship information

          can be found in http://www.cert.org/legal_stuff.html.

          

          * "CERT" and "CERT Coordination Center" are registered in the

          U.S. Patent and Trademark Office

          _______________________________________________________________

          

          NO WARRANTY

          Any material furnished by Carnegie Mellon University and the

          Software Engineering Institute is furnished on an "as is"

          basis. Carnegie Mellon University makes no warranties of any

          kind, either expressed or implied as to any matter including,

          but not limited to, warranty of fitness for a particular

          purpose or merchantability, exclusivity or results obtained

          from use of the material. Carnegie Mellon University does not

          make any warranty of any kind with respect to freedom from

          patent, trademark, or copyright infringement.

          

          Revision History

          

          July 22, 1999  Added link to IN-99-04 in the "Description" section.



-----BEGIN PGP SIGNATURE-----

Version: PGP for Personal Privacy 5.0

Charset: noconv



iQA/AwUBOBCTOVr9kb5qlZHQEQLXyACgjf1IPcgld3mB710DpRLUH/d5GvwAnR9f

Wzgyuuo0Bp2BZuvFc4Vc9tO6

=Mw7B

-----END PGP SIGNATURE-----