Don't most TCP/IP stacks block localhost addresses from coming in over the network?
On Mon, May 16, 2011 at 12:44 PM, ZDI Disclosures < [email protected]> wrote: > ZDI-11-168: Multiple Vendor librpc.dll Remote Information Disclosure > Vulnerability > http://www.zerodayinitiative.com/advisories/ZDI-11-168 > May 16, 2011 > > -- CVE ID: > CVE-2011-0321 & CVE-2011-1210 > > -- CVSS: > 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) > > -- Affected Vendors: > IBM > EMC > > -- Affected Products: > IBM Informix > EMC NetWorker > > -- TippingPoint(TM) IPS Customer Protection: > TippingPoint IPS customers have been protected against this > vulnerability by Digital Vaccine protection filter ID 52. > For further product information on the TippingPoint IPS, visit: > > http://www.tippingpoint.com > > -- Vulnerability Details: > This vulnerability allows remote attackers to register RPC services on > vulnerable installations of EMC Legato Networker and IBM Informix > Dynamic Server. Authentication is not required to exploit this > vulnerability. > > The flaw exists within the librpc.dll component which listens by default > on UDP port 111. When handling the pmap_set request the process verifies > the source address is "127.0.0.1". This communication is via UDP and a > valid source address is not required, a udp packet from source address > "127.0.0.1" can be created sent to this service allowing a remote > attacker to register and unregister RPC services. A remote attack can > use this vulnerability to create a denial of service condition or > eavesdrop on process communications. > > -- Vendor Response: > > EMC fix posted January 31, 2011: > CVE-2011-0321 > http://archives.neohapsis.com/archives/bugtraq/2011-01/0162.html > > http://archives.neohapsis.com/archives/bugtraq/2011-01/att-0162/ESA-2011-003.txt > > IBM issued patch May 16, 2011: > CVE-2011-1210 > 11.10 - http://www.ibm.com/support/docview.wss?uid=swg1IC76179 > 11.50 - http://www.ibm.com/support/docview.wss?uid=swg1IC76177 > 11.70 - http://www.ibm.com/support/docview.wss?uid=swg1IC76178 > > -- Disclosure Timeline: > 2010-11-15 - Vulnerability reported to vendor > 2011-05-16 - Coordinated public release of advisory > > -- Credit: > This vulnerability was discovered by: > * Anonymous > > -- About the Zero Day Initiative (ZDI): > Established by TippingPoint, The Zero Day Initiative (ZDI) represents > a best-of-breed model for rewarding security researchers for responsibly > disclosing discovered vulnerabilities. > > Researchers interested in getting paid for their security research > through the ZDI can find more information and sign-up at: > > http://www.zerodayinitiative.com > > The ZDI is unique in how the acquired vulnerability information is > used. TippingPoint does not re-sell the vulnerability details or any > exploit code. Instead, upon notifying the affected product vendor, > TippingPoint provides its customers with zero day protection through > its intrusion prevention technology. Explicit details regarding the > specifics of the vulnerability are not exposed to any parties until > an official vendor patch is publicly available. Furthermore, with the > altruistic aim of helping to secure a broader user base, TippingPoint > provides this vulnerability information confidentially to security > vendors (including competitors) who have a vulnerability protection or > mitigation product. > > Our vulnerability disclosure policy is available online at: > > http://www.zerodayinitiative.com/advisories/disclosure_policy/ > > Follow the ZDI on Twitter: > > http://twitter.com/thezdi > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
