from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 2B17B440CD
	for <jm@localhost>; Tue,  6 Aug 2002 13:32:02 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Tue, 06 Aug 2002 18:32:02 +0100 (IST)
from outgoing.securityfocus.com (outgoing2.securityfocus.com
    [66.38.151.26]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g76HWck12384 for <legit-lists-secfocus@jmason.org>; Tue, 6 Aug 2002
    18:32:38 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    CEDFB8F371; Tue,  6 Aug 2002 09:16:23 -0600 (MDT)
contact bugtraq-help@securityfocus.com; run by ezmlm
(qmail 10791 invoked from network); 6 Aug 2002 00:35:59 -0000
freefall.freebsd.org: nectar set sender to
    security-advisories@freebsd.org using -f
From bugtraq-return-5951-legit-lists-secfocus=jmason.org@securityfocus.com  Tue Aug  6 18:32:08 2002

Topic:          Bug in NFS server code allows remote denial of service
Affects:        All releases prior to 4.6.1-RELEASE-p7
The Network File System (NFS) allows a host to export some or all of
its filesystems, or parts of them, so that other hosts can access them
over the network and mount them as if they were on local disks.  NFS is
built on top of the Sun Remote Procedure Call (RPC) framework.
A part of the NFS server code charged with handling incoming RPC
messages had an error which, when the server received a message with a
zero-length payload, would cause it to reference the payload from the
previous message, creating a loop in the message chain.  This would
later cause an infinite loop in a different part of the NFS server
Certain Linux implementations of NFS produce zero-length RPC messages
in some cases.  A FreeBSD system running an NFS server may lock up
An attacker in a position to send RPC messages to an affected FreeBSD
system can construct a sequence of malicious RPC messages that cause
1) Disable the NFS server: set the nfs_server_enable variable to "NO"
Alternatively, if there are no active NFS clients (as listed by the
showmount(8) utility), just killing the mountd and nfsd processes
2) Add firewall rules to block RPC traffic to the NFS server from
The following patch has been verified to apply to FreeBSD 4.4, 4.5, and
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
c) Recompile your kernel and modules as described in
The following list contains the revision numbers of each file that was