rpcbind DOS issue

[David Nixon]

We have come across a DOS issue concerning
rpcbind on an HP-UX 11.11 server (PHNE_36168)
and a Fedora NFS client; running a particular
recent version of the Linux Kernel.

Basically lock requests cause rpcbind to core
dump. The appended debug trace illusrates.

Don't have software support, but if anyone wants to look into this issue I am happy to supply further details.

Dave.

[Steven E. Protter]

Shalom,

Not much useful data however:

1) Put in the last bi-annual patch set.
2) Check the ITRC security database http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&subtopic=itrc

If there is nothing on this, file a security report but you will be asked to provide much more than a log.
3) Run security_patch_check available in Bastille package and the patch database and deal with issues presented there.
4) Consider stopping the rpcbind service if you don't need. If its not running, it can't be abused.

SEP

[Dave Olker]

Hi Dave,

Please contact me directly: dave.olker@hp.com.

Thanks,

Dave

[Dave Olker · Accepted solution]

Hi Dave,

Thanks for sending me the information. This is a known problem that we will be releasing a fix for in the next 11.11 and 11.23 ONC patches.

The 11.11 patch ID will be PHNE_37110 and it should be out in November.

Regards,

Dave

[David Nixon]

The November NFS/ONC patch is good news.
Cheers,
Dave.