Executive brief
A vulnerability in the portmapper service allows remote attackers to trick the system into acting as a proxy for unauthorized requests. By making external traffic appear as if it originated from the local server, attackers can bypass security restrictions to access sensitive files or internal services. This could lead to the unauthorized viewing or modification of corporate data, such as files stored on network shares.
Technical details
The portmapper (RPCbind) service contains a design flaw where it can be used to proxy RPC calls to other local services. An attacker can send a 'PMAPPROC_CALLIT' request to the portmapper, which then forwards the request to the target local service using the loopback address or the server's own IP. Because many services (such as NFS) trust requests originating from the local host, this allows an attacker to bypass IP-based export restrictions or authentication mechanisms. This is a network-reachable vulnerability that requires no prior authentication and can result in unauthorized access to any RPC-based service running on the host.
Affected products
- Generic Portmapper (RPCbind)
Timeline
- 1992-06-04: disclosed