Sun Solaris NFSv4未授权网络访问漏洞

漏洞起因
配置错误
 
影响系统
Sun Solaris 10_x86
Sun Solaris 10
Sun OpenSolaris build snv_99
Sun OpenSolaris build snv_96
Sun OpenSolaris build snv_95
Sun OpenSolaris build snv_94
Sun OpenSolaris build snv_93
Sun OpenSolaris build snv_92
Sun OpenSolaris build snv_91
Sun OpenSolaris build snv_90
Sun OpenSolaris build snv_89
Sun OpenSolaris build snv_88
Sun OpenSolaris build snv_87
Sun OpenSolaris build snv_86
Sun OpenSolaris build snv_85
Sun OpenSolaris build snv_84
Sun OpenSolaris build snv_83
Sun OpenSolaris build snv_82
Sun OpenSolaris build snv_81
Sun OpenSolaris build snv_80
Sun OpenSolaris build snv_78
Sun OpenSolaris build snv_77
Sun OpenSolaris build snv_76
Sun OpenSolaris build snv_68
Sun OpenSolaris build snv_67
Sun OpenSolaris build snv_64
Sun OpenSolaris build snv_61
Sun OpenSolaris build snv_59
Sun OpenSolaris build snv_58
Sun OpenSolaris build snv_57
Sun OpenSolaris build snv_54
Sun OpenSolaris build snv_50
Sun OpenSolaris build snv_47
Sun OpenSolaris build snv_45
Sun OpenSolaris build snv_41
Sun OpenSolaris build snv_39
Sun OpenSolaris build snv_36
Sun OpenSolaris build snv_29
Sun OpenSolaris build snv_22
Sun OpenSolaris build snv_19
Sun OpenSolaris build snv_13
Sun OpenSolaris build snv_118
Sun OpenSolaris build snv_117
Sun OpenSolaris build snv_116
Sun OpenSolaris build snv_115
Sun OpenSolaris build snv_114
Sun OpenSolaris build snv_113
Sun OpenSolaris build snv_112
Sun OpenSolaris build snv_111a
Sun OpenSolaris build snv_111
Sun OpenSolaris build snv_110
Sun OpenSolaris build snv_109
Sun OpenSolaris build snv_108
Sun OpenSolaris build snv_107
Sun OpenSolaris build snv_106
Sun OpenSolaris build snv_105
Sun OpenSolaris build snv_104
Sun OpenSolaris build snv_104
Sun OpenSolaris build snv_103
Sun OpenSolaris build snv_102
Sun OpenSolaris build snv_101a
Sun OpenSolaris build snv_101
Sun OpenSolaris build snv_100
Sun OpenSolaris build snv_02
Sun OpenSolaris build snv_01
 
不受影响系统
Sun OpenSolaris build snv_119
 
危害
远程攻击者可以利用漏洞对部分文件的访问。
 
攻击所需条件
攻击者必须访问Sun Solaris。
 
漏洞信息
Sun Solaris是一款商业性质的操作系统。
Sun Solaris NFSv4服务器内核模块’nfs_portmon’可调存在安全问题,允许部分远程非特权用户获得对共享资源的未授权网络访问,如对任意文件的读写。
目前没有详细漏洞细节提供。
 
测试方法
 
厂商解决方案
可参考如下补丁程序:
Sun Solaris 10
Sun 139991-03
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -139991-03-1
Sun Solaris 10_x86
Sun 140109-03
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -140109-03-1
 
漏洞提供者
Anton Lundin