CERT Advisory CA-1999-05 Vulnerability in statd exposes vulnerability in automountd

Systems Affected

Systems running older versions of rpc.statd and automountd

I. Description

This advisory describes two vulnerabilities that are being used together by intruders to gain access to vulnerable systems. The first vulnerability is in rpc.statd, a program used to communicate state changes among NFS clients and servers. The second vulnerability is in automountd, a program used to automatically mount certain types of file systems. Both of these vulnerabilities have been widely discussed on public forums, such as BugTraq, and some vendors have issued security advisories related to the problems discussed here. Because of the number of incident reports we have received, however, we are releasing this advisory to call attention to these problems so that system and network administrators who have not addressed these problems do so immediately. For more information about attacks using various RPC services please see CERT® Incident Note IN-99-04 http://www.cert.org/incident_notes/IN-99-04.html

The vulnerability in rpc.statd allows an intruder to call arbitrary rpc services with the privileges of the rpc.statd process. The called rpc service may be a local service on the same machine or it may be a network service on another machine. Although the form of the call is constrained by rpc.statd, if the call is acceptable to another rpc service, the other rpc service will act on the call as if it were an authentic call from the rpc.statd process.

The vulnerability in automountd allows a local intruder to execute arbitrary commands with the privileges of the automountd process. This vulnerability has been widely known for a significant period of time, and patches have been available from vendors, but many systems remain vulnerable because their administrators have not yet applied the appropriate patches.

By exploiting these two vulnerabilities simultaneously, a remote intruder is able to "bounce" rpc calls from the rpc.statd service to the automountd service on the same targeted machine. Although on many systems the automountd service does not normally accept traffic from the network, this combination of vulnerabilities allows a remote intruder to execute arbitrary commands with the administrative privileges of the automountd service, typically root.

Note that the rpc.statd vulnerability described in this advisory is distinct from the vulnerabilities described in CERT Advisories CA-96.09 and CA-97.26.

II. Impact

The vulnerability in rpc.statd may allow a remote intruder to call arbitrary rpc services with the privileges of the rpc.statd process, typically root. The vulnerablility in automountd may allow a local intruder to execute arbitrary commands with the privileges of the automountd service.

By combining attacks exploiting these two vulnerabilities, a remote intruder is able to execute arbitrary commands with the privileges of the automountd service.

Note

It may still be possible to cause rpc.statd to call other rpc services even after applying patches which reduce the privileges of rpc.statd. If there are additional vulnerabilities in other rpc services (including services you have written), an intruder may be able to exploit those vulnerabilities through rpc.statd. At the present time, we are unaware of any such vulnerabilitity that may be exploited through this mechanism.

III. Solutions

Appendix A contains input from vendors who have provided information for this advisory. We will update the appendix as we receive more information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact your vendor directly.

Appendix A: Vendor Information

Caldera's currently not shipping statd.

(c) Copyright 1998, 1999 Compaq Computer Corporation. All rights reserved.
SOURCE: Compaq Computer Corporation
Compaq Services
Software Security Response Team USA

This reported problem has not been found to affect the as shipped, Compaq's Tru64/UNIX Operating Systems Software.
- Compaq Computer Corporation

We are investigating. We will provide an update when our investigation is complete.

HP is vulnerable to a remote attack against automountd.

Please see the following document for details on workarounds:

HPSBUX9910-104 Security Advisory regarding automountd

Patch development is in progress.

AIX is not vulnerable.

IBM and AIX are registered trademarks of International Business Machines Corporation.

No SCO products are vulnerable.

% IRIX

% rpc.statd
IRIX 6.2 and above ARE NOT vulnerable.
IRIX 5.3 is vulnerable, but no longer supported.

% automountd
With patches from SGI Security Advisory 19981005-01-PX installed,
IRIX 6.2 and above ARE NOT vulnerable.

% Unicos

Currently, SGI is investigating and no further information is
available for public release at this time.

As further information becomes available, additional advisories
will be issued via the normal SGI security information distribution
method including the wiretap mailing list.

SGI Security Headquarters
http://www.sgi.com/Support/security

The following patches are available:

rpc.statd:

Patch OS Version
_____ __________

106592-02 SunOS 5.6
106593-02 SunOS 5.6_x86
104166-04 SunOS 5.5.1
104167-04 SunOS 5.5.1_x86
103468-04 SunOS 5.5
103469-05 SunOS 5.5_x86
102769-07 SunOS 5.4
102770-07 SunOS 5.4_x86
102932-05 SunOS 5.3

The fix for this vulnerability was integrated in SunOS 5.7 (Solaris 7) before it was released.

automountd:

104654-05 SunOS 5.5.1
104655-05 SunOS 5.5.1_x86
103187-43 SunOS 5.5
103188-43 SunOS 5.5_x86
101945-61 SunOS 5.4
101946-54 SunOS 5.4_x86
101318-92 SunOS 5.3

SunOS 5.6 (Solaris 2.6) and SunOS 5.7 (Solaris 7) are not vulnerable.

Sun security patches are available at:
http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-license&nav=pub-patches

Our thanks to Olaf Kirch of Caldera for his assistance in helping us understand the problem and Chok Poh of Sun Microsystems for his assistance in helping us construct this advisory.

Copyright 1999 Carnegie Mellon University.

October 22, 1999	Updated vendor information for Hewlett-Packard Company
July 22, 1999		Added link to IN-99-04 in the "Description" section.
November 9, 1999             Added vendor information for IBM Corporation.