Executive brief
A vulnerability in the network file sharing component of certain older operating systems allows unauthorized users to access shared directories. This occurs when the list of authorized users or systems is too long, causing the security check to fail and default to allowing anyone to connect. An attacker could use this to view sensitive files stored on the network.
Technical details
A vulnerability exists in the NFS mount daemon (mountd) where export lists exceeding 256 characters are improperly handled. This is likely a buffer overflow or parsing error that causes the daemon to fail its access control checks. As a result, an unauthenticated remote attacker can mount exported NFS directories that should otherwise be restricted. The issue was notably identified in SunOS 5.0 and Solaris 2.0. Attackers can gain unauthorized read access to the filesystem over the network.
Affected products
- Sun Microsystems Solaris 2.0
- Sun Microsystems SunOS 5.0
Timeline
- 1994-02-14: disclosed