CVE-2005-0138: High severity SGI IRIX vulnerability

Published Sep 21, 2005

Updated

rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined. NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE definition of a vulnerability.

Affected Software

3 affected components

SGI IRIX=6.5.26

SGI IRIX=6.5.27

SGI IRIX=6.5.25

Remediation

Patch Available

ftp://patches.sgi.com/support/free/security/advisories/20050601-01-U

Event History

Sep 21, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-0138?

The severity of CVE-2005-0138 is considered low since there is no apparent attacker role.

How do I fix CVE-2005-0138?

To mitigate CVE-2005-0138, you should update to a patched version of SGI IRIX beyond 6.5.27.

Which versions of SGI IRIX are affected by CVE-2005-0138?

SGI IRIX versions 6.5.25, 6.5.26, and 6.5.27 are affected by CVE-2005-0138.

Is it safe to use SGI IRIX 6.5.28 in relation to CVE-2005-0138?

Yes, using SGI IRIX 6.5.28 or newer would not be affected by CVE-2005-0138.

What is the main issue with CVE-2005-0138?

CVE-2005-0138 primarily involves rpc.mountd not correctly handling access for anonymous clients with undetermined hostnames.