Bug 64002 (CVE-2004-1014)

We missed the following report from vendor-sec.
The issue is public meanwhile.

Date: Mon, 22 Nov 2004 10:21:42 -0500
From: Josh Bressers <bressers@redhat.com>
To: vendor-sec@lst.de
Subject: [vendor-sec] DoS in nfs-utils statd

Hello,

SGI has reported to us a DoS in statd.

statd doesn't properly ignore SIGPIPE, which means a misconfigured or
malicious peer could shut it down.  It also has several printf
formatting problems (like passing only one argument to a routine with
two or three format specifiers).

The printf formatting problems don't appear to be security related, but do
clarify the code a bit.

The current embargo date for this issue is 2004-12-01 1400UTC.

-- 
    JB

diff -prauN --exclude-from=excludes nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/monitor.c nfs-utils-work/nfs-utils-1.0.6/utils/statd/monitor.c
--- nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/monitor.c	Fri Sep 12 15:41:35 2003
+++ nfs-utils-work/nfs-utils-1.0.6/utils/statd/monitor.c	Sun Jun 20 23:41:01 2004
 #include <string.h>
 #include <unistd.h>
 #include <sys/stat.h>
+#include <errno.h>
 #include <arpa/inet.h>
 #include "misc.h"
 #include "statd.h"
 	sprintf(path, "%s/%s", SM_DIR, mon_name);
 	if ((fd = open(path, O_WRONLY|O_SYNC|O_CREAT, S_IRUSR|S_IWUSR)) < 0) {
 		/* Didn't fly.  We won't monitor. */
-		note(N_ERROR, "creat(%s) failed: %m", path);
+		note(N_ERROR, "creat(%s) failed: %s", path, strerror (errno));
 		nlist_free(NULL, clnt);
 		free(path);
 		goto failure;
diff -prauN --exclude-from=excludes nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/simulate.c nfs-utils-work/nfs-utils-1.0.6/utils/statd/simulate.c
--- nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/simulate.c	Fri Sep 12 15:41:38 2003
+++ nfs-utils-work/nfs-utils-1.0.6/utils/statd/simulate.c	Sun Jun 20 22:51:15 2004
 {
   static char *result;
 
-  dprintf (N_DEBUG, "Recieved state %d for mon_name %s (opaque \"%s\")",
+  dprintf (N_DEBUG, "Received state %d for mon_name %s (opaque \"%s\")",
 	   argp->state, argp->mon_name, argp->priv);
   svc_exit ();
   return ((void *)&result);
diff -prauN --exclude-from=excludes nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/statd.c nfs-utils-work/nfs-utils-1.0.6/utils/statd/statd.c
--- nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/statd.c	Fri Sep 12 16:24:29 2003
+++ nfs-utils-work/nfs-utils-1.0.6/utils/statd/statd.c	Sun Jun 20 22:39:11 2004
 	struct stat st;
 
 	if (stat(SM_DIR, &st) == -1 &&
-	    stat(DIR_BASE, &st) == -1)
+	    stat(DIR_BASE, &st) == -1) {
 		st.st_uid = 0;
+		st.st_gid = 0;
+	}
 
 	if (st.st_uid == 0) {
 		note(N_WARNING, "statd running as root. chown %s to choose different user\n",
 	signal (SIGTERM, killer);
 	/* WARNING: the following works on Linux and SysV, but not BSD! */
 	signal(SIGCHLD, SIG_IGN);
+	/*
+	 * Ignore SIGPIPE to avoid statd dying when peers close their
+	 * TCP connection while we're trying to reply to them. 
+	 */
+	signal(SIGPIPE, SIG_IGN);
 
 	/* initialize out_port */
 	statd_get_socket(out_port);
diff -prauN --exclude-from=excludes nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/svc_run.c nfs-utils-work/nfs-utils-1.0.6/utils/statd/svc_run.c
--- nfs-utils-sgi/nfs-utils-1.0.6/utils/statd/svc_run.c	Fri Sep 12 15:41:40 2003
+++ nfs-utils-work/nfs-utils-1.0.6/utils/statd/svc_run.c	Sun Jun 20 22:40:28 2004
 			if (errno == EINTR || errno == ECONNREFUSED
 			 || errno == ENETUNREACH || errno == EHOSTUNREACH)
 				continue;
-			note(N_ERROR, "my_svc_run() - select: %m");
+			note(N_ERROR, "my_svc_run() - select: %s",
+				strerror (errno));
 			return;
 
 		case 0: