PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICER
{ISSO}, SPECIAL SECURITY OFFICER {SSO}, INFORMATION RESOURCE MANAGER
{IRM} AND AUTOMATED DATA PROCESSOR {ADP} COORDINATORS
U-1,230/DS-SIM {DCPO}
SUBJ:  REVISED PATCH FOR SUNOS /USR/ETC/RPC.MOUNTD VULNERABILITY 
{AUTOMATED SYSTEMS SECURITY INCIDENT SUPPORT TEAM {ASSIST} 92-37}
1.  DISCUSSION: THIS IS A PRIORITY ALERT THAT INTERRUPTS THE
SEQUENCE OF THE BASELINE PACKAGE OF MESSAGES CURRENTLY BEING ISSUED
BY ASSIST.  ASSIST HAS LEARNED ABOUT THE AVAILABILITY OF A REVISED
SECURITY PATCH FOR /USR/ETC/RPC.MOUNTD IN SUN MICROSYSTEMS COMPUTER
CORPORATION OPERATING SYSTEMS.  THIS PATCH FIXES AN ADDITIONAL
VULNERABILITY THAT WAS NOT ADDRESSED IN A PREVIOUSLY RELEASED PATCH. 
UNDER CERTAIN CONDITIONS AN EXPORTED NFS FILESYSTEM CAN BE MOUNTED
BY ANY SYSTEM ON THE INTERNET EVEN THOUGH IT MAY APPEAR THAT ACCESS
TO THE FILESYSTEM IS RESTRICTED TO SPECIFIC HOSTS.  THIS SECURITY
WEAKNESS WOULD ALLOW UNAUTHORIZED REMOTE HOSTS TO MOUNT THE EXPORTED
FILESYSTEM.
2.  SUN HAS PROVIDED PATCHES FOR SUNOS 4.1, SUNOS
4.1{UNDERSCORE}PSR{UNDERSCORE}A, SUNOS 4.1.1, AND SUNOS 4.1.2. 
THESE PATCHES ARE AVAILABLE THROUGH YOUR LOCAL SUN ANSWER CENTER AS
WELL AS THROUGH ANONYMOUS FTP FROM FTP.UU.NET {137.39.1.9} IN THE
/SYSTEMS/SUN/SUN-DIST DIRECTORY. PATCH ID AND FILE INFORMATION ARE
AS FOLLOWS:
FIX                   PATCH ID    FILENAME          CHECKSUM
/USR/ETC/RPC.MOUNTD   100296-02   100296-02.TAR.Z   30606    23
PLEASE NOTE THAT SUN MICROSYSTEMS SOMETIMES UPDATES PATCH FILES. 
IF YOU FIND THAT THE CHECKSUM IS DIFFERENT, PLEASE CONTACT SUN
MICROSYSTEMS FOR VERIFICATION.
3.  RECOMMENDATION: AFTER ACQUIRING THE PATCH, AS ROOT:
A.  MOVE THE EXISTING RPC.MOUNTD ASIDE AND CHANGE THE PERMISSIONS:
MV /USR/ETC/RPC.MOUNTD /USR/ETC/RPC.MOUNTD.OLD
CHMOD 400 /USR/ETC/RPC.MOUNTD.OLD
B.  INSTALL THE NEW VERSION:
CP `ARCH`/RPC.MOUNTD /USR/ETC
CHOWN ROOT.STAFF /USR/ETC/RPC.MOUNTD
CHMOD 755 /USR/ETC/RPC.MOUNTD
C.  KILL THE CURRENTLY RUNNING RPC.MOUNTD AND RESTART IT, OR 
REBOOT THE SYSTEM.  IN EITHER CASE, SYSTEMS WITH FILESYSTEMS MOUNTED
FROM THIS HOST WILL HAVE INTERRUPTIONS IN SERVICE.
4.  POINT OF CONTACT:  ASSIST POINT OF CONTACT FOR THIS MATTER IS
MIKE HIGGINS, COMM {202} 373-8852/55 OR DSN 243-8852/55.  ASSIST
CAN BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER {800} SKY-PAGE,
PIN NUMBER 2133937 {FROM A TOUCH TONE PHONE ENTER THE CALL BACK
NUMBER AFTER THE PROMPT} OR AUTOVON DIAL 243-8000 AND ASK TO HAVE
THE ASSIST DUTY OFFICER PAGED.  ASSIST CAN BE REACHED VIA E-MAIL AT
"DOD-CERT{AT-SIGN}DDN-CONUS.DDN.MIL."