===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : CERT-NL (Gert Meijerink)                    Index  :    S-94-03
Distribution  : World                                       Page   :          1
Classification: External                                    Version:      Final
Subject       : Revised patch for SunOS /usr/etc/rpc.mountd Date   :  15-Feb-94
===============================================================================

CERT-NL received information about a revised patch for SunOS
/usr/etc/rpc.mountd Vulnerability.

We advise you to carefully read this advisory and take appropriate action.

We thank CERT/CC for providing this information.

=============================================================================

                    *** THIS IS A REVISED CERT ADVISORY ***
           *** IT CONTAINS NEW VULNERABILITY AND PATCH INFORMATION ***
                  *** SUPERSEDES CERT-NL ADVISORY S-92-12  ***

CERT-NL has received information concerning a vulnerability in 
/usr/etc/rpc.mountd in Sun Microsystems, Inc. SunOS 4.1.1, 4.1.2, 
4.1.3, and 4.1.3c.  SunOS 4.1.3.u.1, Solaris 2.x, and Solbourne's 4.1B 
and 4.1C are not vulnerable.

Sun has produced a patch for this vulnerability for sun3 and sun4
architectures.  It is available through your local Sun Answer Center
as well as through anonymous FTP from ftp.nic.surfnet.nl in the
surfnet/net-security/cert-nl/patches/sun-fixes directory.

This vulnerability is currently being exploited.  Please review CERT-NL
Advisory S-94-02 'Ongoing Network Monitoring Attacks'.
 
-----------------------------------------------------------------------------

I.   Description

     If an access list of hosts within /etc/exports is a string 
     over 256 characters or if the cached list of netgroups exceeds
     the cache capacity then the filesystem can be mounted by anyone.
      
II.  Impact

     Unauthorized remote hosts will be able to mount the filesystem.
     This will allow unauthorized users read and write access to files
     on mounted filesystem.

III. Solution

     Obtain and install the appropriate patch following the instructions
     included with the patch.

     Patch-ID   Filename         BSD        MD5
                                 Checksum   Checksum
     100296-04  100296-04.tar.Z  42492 40   20a76c75abadd3360ad92091a25ceb3c

---------------------------------------------------------------------------
If you believe that your system has been compromised, contact  CERT-NL
or your local Site Security Contact (SSC).
---------------------------------------------------------------------------
==============================================================================
CERT-NL is the Computer Emergency Response Team, located in The
Netherlands. CERT-NL is a Full Member of the Forum of Incident Response
and Security Teams (FIRST). The constituency of CERT-NL are the SURFnet
connected institutions.

Past CERT-NL Security Bulletins and other CERT-NL related material can
be found on the anonymous FTP server of SURFnet bv:
"ftp.nic.surfnet.nl" [192.87.46.3], in the directory
"surfnet/net-security/cert-nl/docs/bulletin".  This information is also
available using email. Send an email saying "help" to
"mailserv@nic.surfnet.nl".

In case of computer or network security problems please contact CERT-NL
or the CERT of your own constituency. Please be aware of the fact that
we are one (when DST is in effect two) hour(s) ahead of Universal Time
Coordinated (i.e. UTC+0100 (UTC+0200)).
Email:     cert-nl@surfnet.nl
Phone:     +31 30 310290
Fax:       +31 30 340903
Snailmail: SURFnet bv
           Attn. CERT-NL
           P.O. Box 19035
           NL - 3501 DA  UTRECHT
           The Netherlands
A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST
members on request.
==============================================================================