rpc.statd Format Attack
advICE :Intrusions : 2001737

Summary

Probably attack against the rpc.yppasswd buffer overflow vulnerability.

Details

This service allows users to change their network passwords in a YP (Yellow Pages) environment. A remote buffer overflow vulnerability exists, and there are active exploit scripts in the wild exploiting this. Since this service must run with root/superuser privileges, a successful exploit gives the intruder full control over the machine.

Action

This service is only needed for backwards compatibility. It should be disabled in most networks. If you must run this service on your servers, then obtain the latest patch.

Systems Affected

Sun Solaris 8.0
Sun Solaris 7.0 (2.7)
Sun Solaris 2.6

Trigger

This event triggers when any of the input strings to the UPDATE procedure exceed 64-characters.

parametric information length The length of the input into the field. data Some of the data sent as input to the field. field The name of the field.

 
Version appeared: 3.0