Solaris NFS lockd Remote Denial of Service Vulnerability

Bugtraq ID:	5986
Class:	Unknown
CVE:	CVE-2002-1228
Remote:	Yes
Local:	No
Published:	Oct 17 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	Vulnerability announced in a Sun advisory.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.5
Not Vulnerable:

Solaris NFS lockd Remote Denial of Service Vulnerability

A denial of service vulnerability has been reported in the lockd daemon on Solaris.

It has been reported that it is possible for a remote attacker to crash the Solaris lockd daemon, resulting in a denial of service. If this situation were to occur, valid NFS connections would no longer be established by the target server.

Precise technical details regarding the source of this issue are not yet known. This bid will be updated as more information becomes available.

It should be noted that, although not yet confirmed, this may be similar to the vulnerability described in bid 1372.

Solaris NFS lockd Remote Denial of Service Vulnerability

There are reports of a publicly available tool to exploit this vulnerability.

Solaris NFS lockd Remote Denial of Service Vulnerability

Solution:
Solaris has released patches addressing this issue. It should be noted that a final resolution for Solaris 2.5.1 is pending completion.

Patches:


Sun Solaris 7.0_x86

• Sun 106542-20
  http://sunsolve.sun.com


• Sun 109745-02
  Must be used with patch 106542-23 or later
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109745&rev=02

Sun Solaris 7.0

• Sun 106541-23
  Must be combined with patch 109744-02 or later.
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=106541&rev=23


• Sun 109744-02
  Must be combined with patch 106541-23 or later.
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109744&rev=02

Sun Solaris 8_x86

• Sun 109784-02
  Must be used with patch 111322-03 or later
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109784&rev=02


• Sun 111322-03
  Must be used with patch 109784-02 or later
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=111322&rev=03

Sun Solaris 8_sparc

• Sun 109783-02
  Must be used with patch 111321-03 or later
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=109783&rev=02


• Sun 111321-03
  Must be used with patch 109783-02 or later
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=111321&rev=03

Sun Solaris 9

• Sun 113278-01
  Must be used with patch 113279-01 or later
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=113278&rev=01


• Sun 113279-01
  Must be used with patch 113278-01 or later
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=113279&rev=01

Sun Solaris 2.5.1 _x86

• Sun 103641-42
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=103641&rev=42


• Sun 104335-02
  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F47815

Sun Solaris 2.5.1

• Sun 103640-42
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=103640&rev=42


• Sun 104334-02
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=104334&rev=02

Solaris NFS lockd Remote Denial of Service Vulnerability

References:

• NFS Denial of Service can be Caused by a Client Application Killing the lockd(1M (Sun)
  
• Vulnerability Note VU#855635 (CERT/CC)