Remote Root Vulnerability in rpcbind portmapper

vendor:

rpcbind portmapper

by:

SecurityFocus

7,5

CVSS

HIGH

Remote Root Vulnerability

264

CWE

Product Name: rpcbind portmapper

Affected Version From: 0.2.0

Affected Version To: 0.2.3

Patch Exists: YES

Related CWE: CVE-2002-0392

CPE: //a:rpcbind

Metasploit: https://www.rapid7.com/db/vulnerabilities/apache-httpd-cve-2002-0392/, https://www.rapid7.com/db/vulnerabilities/http-apache2-chunked-transfer-int-bof/, https://www.rapid7.com/db/vulnerabilities/apache-httpd-1_3_x-apache-chunked-encoding-vulnerability-cve-2002-0392/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux, Solaris, HP-UX, AIX, IRIX, FreeBSD, OpenBSD, NetBSD

2002

Remote Root Vulnerability in rpcbind portmapper

RPC (Remote Procedure Call) allows a program to request a service from a program located in another computer in a network without requiring detailed information on the network configuration. An attacker capable of forging a pmap_set/pmap_unset udp packet can cause the remote host to register or unregister arbitrary RPC programs. This can permit an attacker to carry out a denial of services by disabling key services on the target host, including mountd, nfsd and ypserv. Because it allows a malicious local user to register rpc programs on the server, depending on the program the attacker chooses to register, this vulnerability can allow a compromise of root privilege, potentially extending to other systems on the local network.

Mitigation:

It is recommended that users upgrade to the latest version of rpcbind portmapper.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1893/info

A remote root vulnerability exists in certain versions of rpcbind portmapper. 

RPC (Remote Procedure Call) allows a program to request a service from a program located in another computer in a network without requiring detailed information on the network configuration.

An attacker capable of forging a pmap_set/pmap_unset udp packet can cause the remote host to register or unregister arbitrary RPC programs.

This can permit an attacker to carry out a denial of services by disabling key services on the target host, including mountd, nfsd and ypserv.

Because it allows a malicious local user to register rpc programs on the server, depending on the program the attacker chooses to register, this vulnerability can allow a compromise of root privilege, potentially extending to other systems on the local network.

Note that, in addition to the platforms listed as vulnerable, others have not been test and may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20376.tgz