SunOS ypxfrd Vulnerability

Bugtraq ID:	45
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 04 1992 12:00AM
Updated:	Jun 04 1992 12:00AM
Credit:
Vulnerable:	Sun SunOS 4.1.3 c Sun SunOS 4.1.3
Not Vulnerable:

SunOS ypxfrd Vulnerability

ypxfrd will send maps to anyone. ypxfrd does not check whether the person transferring the map is root on his machine, when the map is ``secure''. As a consequence, any user can get the password map if the NIS master is running ypxfrd.

This is Sun Bug ID 1082320.

SunOS ypxfrd Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

SunOS ypxfrd Vulnerability

Solution:
Apply Sun Patch ID 100482-08.

This patch enables "ypxfrd" to use a /var/yp/securenets
file and, if present, only responds to IP addresses in the
range given. This file is only read when the daemon
starts. To get a change in /var/yp/securenets
to take effect, one must kill and restart the daemons.

The format of the file is one of more lines of:

netmask netaddr

e.g.

255.255.0.0 128.30.0.0
255.255.255.0 128.311.10.0

In the 2nd example, the netmask is 255.255.255.0
and the network address is 128.311.10.0 . This
setup will only allow the ypserv to respond to
those IP addresses which are within the subnet
128.311.10 range.

SunOS ypxfrd Vulnerability

References:

• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)