Executive brief
A vulnerability in the Solaris operating system allows the rpcbind service to listen on unpredictable, high-numbered network ports. This service is responsible for mapping RPC services to network addresses, and its exposure can allow attackers to bypass traditional firewall rules that only block the standard port 111. An attacker could exploit this to gain unauthorized access to system services, potentially leading to data theft or system disruption.
Technical details
The rpcbind utility in Sun Solaris (SunOS) versions 2.3 through 2.5.1 contains a design flaw where it binds to an additional, non-standard high-numbered UDP port in addition to the standard port 111. This behavior facilitates firewall circumvention because security administrators typically only filter traffic to the well-known port 111. A remote, unauthenticated attacker can interact with the RPC service via this high-numbered port to perform unauthorized RPC calls. This can lead to information disclosure, unauthorized modification of data, or denial of service depending on the specific RPC services registered. The vulnerability is reachable over the network without user interaction.
Affected products
- Sun Microsystems Solaris 2.3, 2.4, 2.5, 2.5.1
- Sun Microsystems SunOS 5.3, 5.4, 5.5, 5.5.1
Timeline
- 1997-06-04: disclosed: NVD Published Date