Provided by Aanval (Snort & Syslog Intrusion Detection and Correlation Engine) www.aanval.com
--
GEN:SID | 1:2093 |
Message | RPC portmap proxy integer overflow attempt TCP |
Summary | vulnerability in xdrmem_getbytes used by XDR in RPC portmap services. |
Impact | System compromise, denial of service, execution of arbitrary code, information disclosure. |
Detailed Information | A vulnerability exists in various implementations of external data representation (XDR) libraries. An integer overflow in a component (xdrmem_getbytes) used by XDR can lead to a buffer overflow. The XDR libraries are widely used by multiple vendors to provide a framework for data transmission across networks. This is most commonly used in RPC implementations. A specially crafted rpc request can lead to remote system compromise and super user access to the target host. Additionally, a denial of service and execution of arbitrary code with the privilege of the super user is also possible. |
Affected Systems | Multiple vendors including all those using: Sun Microsystems Network Services Library (libnsl) GNU C library with sunrpc (glibc) BSD-derived libraries with XDR/RPC routines (libc) |
Attack Scenarios | The attacker needs to send a specially crafted rpc request to the target host. |
Ease of Attack | Simple |
Corrective Action | Apply the appropriate vendor supplied patches. Upgrade the vendor libraries to the latest non-affected versions. Any statically linked binaries and applications must be recompiled and restarted after the upgrade. Disallow all RPC requests from external sources and use a firewall to block access to RPC ports from outside the LAN. |
Additional References | Bugtraq: http://www.securityfocus.com/bid/7123 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0028 CERT: http://www.cert.org/advisories/CA-2003-10.html http://www.kb.cert.org/vuls/id/516825 http://www.kb.cert.org/vuls/id/192995 |
Rule References | bugtraq: 7123 cve: 2003-0028 nessus: 11420 |
--
DID:349802
--
http://www.aanval.com/