FreeBSD Security Advisory FreeBSD-SA-06:10.nfs

[Colin Percival]

FreeBSD Security Advisories wrote:
> Topic:          Remote denial of service in NFS server
> [...]
> IV.  Workaround
> 
> 1) Disable the NFS server: set the nfs_server_enable variable to "NO"
>    in /etc/rc.conf, and reboot.
> 
>    Alternatively, if there are no active NFS clients (as listed by the
>    showmount(8) utility), simply killing the mountd and nfsd processes
>    should suffice.
> 
> 2) Add firewall rules to block RPC traffic to the NFS server from
>    untrusted hosts.

There's one more workaround: Since this problem only affects RPC messages
incoming via TCP, disabling the use of TCP with NFS will correct this
while still allowing NFS to run over UDP.

To disable use of TCP for NFS, remove the "-t" flag from nfs_server_flags
in /etc/rc.conf and reboot.

Colin Percival