Skip to content
  • There are no suggestions because the search field is empty.

RSA Identity Governance & Lifecycle Capacity Overflow Attack Vulnerability

Advisory Type

Unknown


Advisory Content

Article Number

000036249

Applies To

Article Summary

Resolution steps for capacity overflow attack vulnerability on /var file system.

Alert Impact

Impacted - Apply RSA Remedy

Alert Impact Explanation

The /var/tmp directory contains temporary files written by programs. There are several known capacity overflow attacks for the /var file system.

Resolution

A capacity overflow attack on the /var file system can be mitigated by binding the /var/tmp directory to the /tmp directory.  This ensures no user or programs can consume all of the space in the /var file system. 

The following steps can be taken to automatically bind /var/tmp to /tmp at system boot time.
  1. Log in to the appliance using root
  2. Search /etc/fstab to check that /var/tmp is not already bound to another directory.  Issue the following command:
grep /var/tmp /etc/fstab
 
If the grep command returns no output, or returns only lines that do not "bind" /var/tmp, continue with step 3 below.
If the grep command returns an error, or finds a line that "binds" /var/tmp, do not continue.
  1. Use the commands below to backup the current /etc/fstab file. Each command should return no output and no errors:
mkdir /tmp/ACM-83001-backup
cp /etc/fstab /tmp/ACM-83001-backup
  1. Use the following command to add a line to file /etc/fstab to mount /tmp to /var/tmp.  The command should return no output and no errors.
echo "/tmp /var/tmp none bind 0 0" >> /etc/fstab 
  1. Check that file /etc/fstab has been modified correctly by typing the command:
cat /etc/fstab 
The cat command should show that the last line in /etc/fstab is now:
/tmp /var/tmp none bind 0 0
  1. Reboot the appliance.

Notes

Reboot Required

A reboot is required to perform the mount because there are many lock files and communication-related temporary files maintained in /var/tmp. Running an explicit mount command in a running system may lead to issues when a local Oracle database is in use.
 

Backout

Should this change need to be backed out, the original /etc/fstab file can be copied from the backup directory to its original location with the following command:
cp /tmp/ACM-83001-backup/fstab /etc