MOSIX Cluster Environment for Linux Allows Remote Users to Crash the Cluster With Arbitrary Packets
|
Date: Apr 24 2002
|
Impact: Denial of service via network
|
Exploit Included: Yes
|
Version(s): 1.5.7
|
Description: A vulnerability was reported in the MOSIX cluster environment for Linux systems. A remote user can cause the cluster to crash.
A remote user can send arbitrary packets to the mosix-tcp port (743), normally used for the MOSIX filesystem, to cause MOSIX to crash.
It
is also reported that the clumpOS-Mosix Node (apparently available from http://clumpos.pysoftware.org) has no vnc password set by
default, so any remote user within the cluster network can gain root level access to the affected node.
|
Impact: A remote user can cause the cluster to crash.
|
Solution: No solution was available at the time of this entry.
The author of the report indicates that you can disable dfsa and mfs in the
mosixkernelpatch configuration to avoid this vulnerability.
The author also notes that the default vnc password issue will be
fixed in the next release of clumpOS.
|
Vendor URL: www.mosix.org/ (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any)
|
Reported By: enrico@wizards-of-source.org
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 23 Apr 2002 23:11:54 +0200 (CEST)
From: enrico@wizards-of-source.org
Subject: Denial of Service in Mosix 1.5.x
|
Hi,
mosix and probalby open-Mosix are vulnerable to an Denial of Service
attack, the problem lies in the mosix-protocol-stack, mosix are not able
to handle garbage-packets correctly.
MosiX is an cluster-environment for Linux and is avail from www.mosix.org
also vulnerable is to this is the clumpOS-Mosix client cd, the
clumpOS-Mosix Node has also no vnc password set so anyone in the
cluster-network can gain root-access to the affected node. this issue will
be fixed in the next clumpOS Version.
this has been succefully tested on mosix 1.5.7 and latest clumpOS with
dfsa and mfs enabled.
fix:
disable mfs in kernel-configuration
www.h07.org
German Unix/Linux Developer Team
|
|
