BID:450

Solaris rpc.statd rpc Call Relaying Vulnerability

Info

Solaris rpc.statd rpc Call Relaying Vulnerability

Bugtraq ID:	450
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 07 1999 12:00AM
Updated:	Jun 07 1999 12:00AM
Credit:	First released in Sun Advisory 00186 on June 7, 1999.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3

Not Vulnerable:

Discussion

Solaris rpc.statd rpc Call Relaying Vulnerability

The rpc service rpc.statd, shipped with all major versions of Sun's solaris, is the status monitoring service for NFS file locking. The vulnerability lies in rpc.statd's ability to relay rpc calls to other rpc services without being validated by the access controls of the other rpc services. This can give the attacker the ability to redirect malicious rpc commands through rpc.statd (which runs as root) to services they may not normally have access to.

Exploit / POC

Solaris rpc.statd rpc Call Relaying Vulnerability

Exploit code is available:

/data/vulnerabilities/exploits/wow.c

Solution / Fix

Solaris rpc.statd rpc Call Relaying Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com

Sun Solaris 2.6