SunOS ypserv domain guessing Vulnerability

Bugtraq ID:	44
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 04 1992 12:00AM
Updated:	Jun 04 1992 12:00AM
Credit:
Vulnerable:	Sun SunOS 4.1.1 Sun SunOS 4.1 Sun SunOS 4.0.3 c
Not Vulnerable:

SunOS ypserv domain guessing Vulnerability

The NIS server (ypserv) will send copies for NIS maps to anyone that can guess the correct NIS domain.

This is Sun Bug ID 1036869.

SunOS ypserv domain guessing Vulnerability

Use ypget.

SunOS ypserv domain guessing Vulnerability

Solution:
Apply Sun Patch ID 100482-08.

This patch enables "ypserv" to use the file /var/yp/securenets
and, if present, only responds to IP addresses in the
range given. This file is only read when the daemon
starts. To get a change in /var/yp/securenets
to take effect, one must kill and restart the daemons.

The format of the file is one of more lines of:

netmask netaddr

e.g.

255.255.0.0 128.30.0.0
255.255.255.0 128.311.10.0

In the 2nd example, the netmask is 255.255.255.0
and the network address is 128.311.10.0 . This
setup will only allow the ypserv to respond to
those IP addresses which are within the subnet
128.311.10 range.

SunOS ypserv domain guessing Vulnerability

References:

• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)