freebsd security advisories securityadvisoriesfreebsdorg begin pgp signed message freebsdsa0236nfs security advisory freebsd project topic bug nfs server code allows remote denial service category core module nfs announced 20020805 credits mike junk affects releases prior 461releasep7 46stable prior correction date corrected 20020719 171953 utc releng_4 20020801 193155 utc releng_4_6 20020801 193154 utc releng_4_5 20020801 193154 utc releng_4_4 freebsd background network file system nfs allows host export filesystems parts hosts access network mount local disks nfs built top sun remote procedure call rpc framework ii problem description part nfs server code charged handling incoming rpc messages error server received message zerolength payload would cause reference payload previous message creating loop message chain would later cause infinite loop different part nfs server code tried traverse chain iii impact certain linux implementations nfs produce zerolength rpc messages cases freebsd system running nfs server may lock clients connect attacker position send rpc messages affected freebsd system construct sequence malicious rpc messages cause target system lock iv workaround 1 disable nfs server set nfs_server_enable variable etcrcconf reboot alternatively active nfs clients listed showmount8 utility killing mountd nfsd processes suffice 2 add firewall rules block rpc traffic nfs server untrusted hosts v solution following patch verified apply freebsd 44 45 46 systems download relevant patch location verify detached pgp signature using pgp utility fetch ftpftpfreebsdorgpubfreebsdcertpatchessa0236nfspatch fetch ftpftpfreebsdorgpubfreebsdcertpatchessa0236nfspatchasc b apply patch cd usrsrc patch pathtopatch c recompile kernel modules described reboot system vi correction details following list contains revision numbers file corrected freebsd path revision branch srcsysnfsnfs_socketc releng_4 16025 releng_4_6 1602321 releng_4_5 1602161 releng_4_4 1602341 begin pgp signature version gnupg v107 freebsd iqcvawubpu8ntvuuhi5z0oilaqhmzapl80qudeelkhfzyxg5ppf6cuwkreacavl lp1ojdhlwuw32k4tm0yv505tu2wgnl2dsqwkfemzxlhzfsmrbubqx8efgo6sb nheetsfu4t81ylhtyqewftrweb5a1tgjayv67wybwzxulkyj9qnrlkf4ptoc0e3 t1ycn0dnya 2ysa end pgp signature mon 5 aug 2002 165007 0700 pdt freebsd security advisory freebsdsa0236nfs