Legato NetWorker PortMapper obtain information
| legato-portmapper-obtain-information (21893) |  Medium Risk |
Description:
Legato NetWorker could allow a remote authenticated attacker to obtain sensitive information. By issuing pmap_set and pmap_unset calls using the PortMapper (lgtomapper), a remote authenticated attacker could unregister NetWorker RPC services, register RPC services, monitor NetWorker process communications or cause a denial of service.
NOTE: Sun StorEdge Enterprise Backup Software versions 7.2, 7.1, 7.0, and Solstice Backup Software versions 6.0 and 6.1 are also affected by this vulnerability.
Consequences:
Obtain Information
Remedy:
For Sun StorEdge Enterprise Backup Software:
Apply the appropriate hotfix as listed in the Sun Alert ID: 101886. See References.
For Solstice Backup Software:
Apply the appropriate hotfix as listed in the Sun Alert ID: 101886. See References.
For Legato NetWorker:
Apply the appropriate hotfix as listed in the Legato Technical Product Alert August 16, 2005. See References.
References:
- CIAC INFORMATION BULLETIN p-281: Security Vulnerabilities in the Sun StorEdge Enterprise Backup Software.
- Legato Technical Product Alert August 16, 2005: Legato PortMapper and Remote RPC Access.
- Sun Alert ID: 101886: Security Vulnerabilities in the Sun StorEdge Enterprise Backup Software.
- BID-14582: EMC Legato Networker Multiple Vulnerabilities
- CVE-2005-0359: The Legato PortMapper in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 does not restrict access to the pmap_set and pmap_unset commands, which allows remote attackers to (1) cause a denial of service by using pmap_unset to un-register a NetWorker service, or (2) obtain sensitive information from NetWorker services by using pmap_set to register a new service.
- OSVDB ID: 18802: Legato NetWorker lgtomapper Unauthorized RPC Service Unregister DoS
- SA16464: Legato NetWorker Multiple Vulnerabilities
- SA16470: Sun StorEdge Enterprise Backup Vulnerabilities
- SECTRACK ID: 1014713: Legato NetWorker AUTH_UNIX, Database, and Portmapper Authentication Can Be Bypassed By Remote Users
- US-CERT VU#801089: EMC Legato NetWorker portmapper allows remote calls to pmap_set and pmap_unset
Platforms Affected:
- EMC Legato NetWorker
- Sun Solaris Management Console Server
- Sun Solstice Backup 6.0
- Sun Solstice Backup 6.1
- Sun StorEdge Enterprise Backup Software 7.0
- Sun StorEdge Enterprise Backup Software 7.1
- Sun StorEdge Enterprise Backup Software 7.2
Reported:
Aug 16, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net