Signature Detail

NFS Incorrect Credential Length

This protocol anomaly is an NFS packet with an authentication scheme of AUTH_DES that has a credential mismatch; the sum of all RPC credential fields does not match the value in the credential length field.

Extended Description

If the AUTH_DES scheme is enabled, and the declared authentication-length value does not match the actual size of the authentication token field, this constitutes a protocol anomaly which may indicate a network configuration error. It could also indicate a malicious attempt to execute an attack against the affected network via injection of malformed RPC datagrams. The impact of such malformed packets depends entirely upon the implementation of NFS that handles them.

References

• URL: http://www.faqs.org/rfcs/rfc1813.html
• URL: http://www.faqs.org/rfcs/rfc1094.html
• URL: http://www.faqs.org/rfcs/rfc2623.html