|
Brought to you by:
Suppliers of:
|
|
|
| |
| RPC's portmapper is a program that enables remote and local application clients to locate the port(s) on which RPC application have been dynamically binded to. Portmapper was found to be vulnerable to a Denial of Service attack and a possible root compromise. |
| |
Credit:
|
| |
The RPC portmapper uses a function called pmap_(un)set to (un)register application into the portmapper's list, this is done by sending a UDP or TCP packet to the RPC port (it's well-known port setting is 111) requesting a pmap_(un)set function with the application's name.
The portmapper doesn't use a secure authentication protocol to check whether the request was valid or not but rather checks the following:
1) Source port address should be localhost.
2) Source port should not be a privileged one.
Because on some systems the function used to retrieve the local address get_myaddress() returns the local IP instead of '127.0.0.1' it is possible to forge (also known as spoof) these pmap_(un)set packets.
This could lead to any of the following scenarios:
1) Denial of Service, caused by the unregistering of RPC applications such as: rpc.mountd, rpc.nfsd, ypbind, ypserv and etc.
2) Portmapper flood, making the portmapper unable to respond to valid requests.
3) Root compromise, this is done by registering a "compliant" RPC application, for example a rogue ypserver/ypbind, which will mimic the real RPC application making it possible to gain root access.
The vulnerability was found by: ga.
|
|
|
|
|
