Bugtraq mailing list archives
Re: (Q) Sun Rpcbind problem.
From: casper () HOLLAND SUN COM (Casper Dik)
Date: Fri, 10 Apr 1998 20:52:32 +0200
Lately, there is an annoucement from Sun regarding security problem with its rpcbind. At the office, one of the solaris machine uses a rpcbind replacement: part of the README is attached at the end. Does anyone have an idea if I should upgrade to the Sun rpcbind, or the replacement rpcbind is OK?
I've talked some with Wietse, and it seems his replacement rpcbind does exactly the same thing wrong as teh real thing. However, this is not big security problem people can exploit at will. It requires teh system administrator to want to kill and restart rpcbind. It will then dump out the tables to /tmp (unsafely) and when started up it will reread them (also unsafely). So if you refrain from killing rpcbind with SIGINT or SIGTERM, you should be OK. If you have "set nfssrv:nfs_portmon = 1" in /etc/system, you have little to worry about when it come sto rpcbind as shipped by Sun, it also now filters many different indirect RPC calls. (Indirect RPC calls are required to suport broadcast RPC) Wietse's rpcbind continues to offer the advantage of filtering and logging, but it should be noted that rpcbind need not be involved in remote procedure calls at all. Portscanning and then calling also find rpc services. Casper
Current thread:
- BSD coredumps follow symlinks Denis Papp (Mar 28)
- nmap -U <host> undetectable by netranger v2.0 Codex (Apr 01)
- portmap 4.0-8 DoS Michal Zalewski (Apr 01)
- Re: portmap 4.0-8 DoS Peter van Dijk (Apr 07)
- BSDI inetd crash Mark Schaefer (Apr 07)
- Re: BSDI inetd crash FrontLine Assembly (Apr 08)
- SGI O2 ipx security issue Fabrice Planchon (Apr 08)
- BIND vulnerability test program.. Joshua J. Drake (Apr 09)
- (Q) Sun Rpcbind problem. Chiaki Ishikawa (Apr 10)
- Re: (Q) Sun Rpcbind problem. Casper Dik (Apr 10)
- Wietse's RPCBIND Wietse Venema (Apr 10)
- announce: weaken for netscape !! (fwd) Ken Williams (Apr 10)
- Communicator exploits Fernand Portela (Apr 10)
- Sun rpcbind Nicolas Dubee (Apr 10)
- Re: Sun rpcbind Aaron Bornstein (Apr 10)
- QW vulnerability Glenn F. Maynard (Apr 07)
- AppleShare IP Mail Server Chris Wedgwood (Apr 07)
- Re: AppleShare IP Mail Server David Luyer (Apr 07)
- Re: AppleShare IP Mail Server James W. Abendschan (Apr 07)