Executive brief
A vulnerability in the Solaris operating system's network file sharing component allows unauthorized individuals to discover the names and locations of files on the server. By analyzing specific error messages, an attacker can map out the server's file system without having proper access permissions. This information disclosure can be used to plan more targeted attacks or identify sensitive data stored on the system.
Technical details
The rpc.mountd daemon in Solaris 2.0 and SunOS 5.0 contains an information disclosure vulnerability. The daemon returns distinct error messages when a remote user attempts to mount or access paths, allowing an attacker to differentiate between files that exist and those that do not. This side-channel or verbose error reporting allows for remote, unauthenticated file system enumeration. Attackers can use this to verify the existence of sensitive configuration files or user directories. Patches were historically released by Sun Microsystems to address this behavior in the RPC mount service.
Affected products
- Sun Microsystems Solaris 2.0, 5.0
Timeline
- 1998-04-29: disclosed