Description

SGI has issued an update for rpc.mountd. This fixes multiple vulnerabilities, which can be exploited by malicious people to cause a Denial of Service or gain knowledge of certain system information.

1) The rpc.mountd service returns various replies depending on whether a requested file exists or not. This can be exploited to enumerate files present on the system by attempting to mount them and looking at the returned error messages.

2) The rpc.mountd service may accept connections from unprivileged ports when configured with the "-n" option.

3) An unspecified vulnerability can be exploited to cause a Denial of Service.

Solution
Upgrade to 6.5.23 or apply patches:
Further details available to Secunia VIM customers

Changelog
Further details available to Secunia VIM customers

Original Advisory
rpc.mountd Vulnerabilities
ftp://patches.sgi.com/support/free/security/advisories/20031102-01-P.asc

Deep Links
Links available to Secunia VIM customers