full-disclosure - Re: ZDI-11-168: Multiple Vendor librpc.dll Remote Information Disclosure Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 16 May 2011 16:20:48 -0700
From: Dan Kaminsky <dan@...para.com>
To: ZDI Disclosures <zdi-disclosures@...pingpoint.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: ZDI-11-168: Multiple Vendor librpc.dll Remote
 Information Disclosure Vulnerability

Don't most TCP/IP stacks block localhost addresses from coming in over the
network?

On Mon, May 16, 2011 at 12:44 PM, ZDI Disclosures <
zdi-disclosures@...pingpoint.com> wrote:

> ZDI-11-168: Multiple Vendor librpc.dll Remote Information Disclosure
> Vulnerability
> http://www.zerodayinitiative.com/advisories/ZDI-11-168
> May 16, 2011
>
> -- CVE ID:
> CVE-2011-0321 & CVE-2011-1210
>
> -- CVSS:
> 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
>
> -- Affected Vendors:
> IBM
> EMC
>
> -- Affected Products:
> IBM Informix
> EMC NetWorker
>
> -- TippingPoint(TM) IPS Customer Protection:
> TippingPoint IPS customers have been protected against this
> vulnerability by Digital Vaccine protection filter ID 52.
> For further product information on the TippingPoint IPS, visit:
>
>    http://www.tippingpoint.com
>
> -- Vulnerability Details:
> This vulnerability allows remote attackers to register RPC services on
> vulnerable installations of EMC Legato Networker and IBM Informix
> Dynamic Server. Authentication is not required to exploit this
> vulnerability.
>
> The flaw exists within the librpc.dll component which listens by default
> on UDP port 111. When handling the pmap_set request the process verifies
> the source address is "127.0.0.1". This communication is via UDP and a
> valid source address is not required, a udp packet from source address
> "127.0.0.1" can be created sent to this service allowing a remote
> attacker to register and unregister RPC services. A remote attack can
> use this vulnerability to create a denial of service condition or
> eavesdrop on process communications.
>
> -- Vendor Response:
>
> EMC fix posted January 31, 2011:
> CVE-2011-0321
> http://archives.neohapsis.com/archives/bugtraq/2011-01/0162.html
>
> http://archives.neohapsis.com/archives/bugtraq/2011-01/att-0162/ESA-2011-003.txt
>
> IBM issued patch May 16, 2011:
> CVE-2011-1210
> 11.10 - http://www.ibm.com/support/docview.wss?uid=swg1IC76179
> 11.50 - http://www.ibm.com/support/docview.wss?uid=swg1IC76177
> 11.70 - http://www.ibm.com/support/docview.wss?uid=swg1IC76178
>
> -- Disclosure Timeline:
> 2010-11-15 - Vulnerability reported to vendor
> 2011-05-16 - Coordinated public release of advisory
>
> -- Credit:
> This vulnerability was discovered by:
>    * Anonymous
>
> -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, The Zero Day Initiative (ZDI) represents
> a best-of-breed model for rewarding security researchers for responsibly
> disclosing discovered vulnerabilities.
>
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
>
>    http://www.zerodayinitiative.com
>
> The ZDI is unique in how the acquired vulnerability information is
> used. TippingPoint does not re-sell the vulnerability details or any
> exploit code. Instead, upon notifying the affected product vendor,
> TippingPoint provides its customers with zero day protection through
> its intrusion prevention technology. Explicit details regarding the
> specifics of the vulnerability are not exposed to any parties until
> an official vendor patch is publicly available. Furthermore, with the
> altruistic aim of helping to secure a broader user base, TippingPoint
> provides this vulnerability information confidentially to security
> vendors (including competitors) who have a vulnerability protection or
> mitigation product.
>
> Our vulnerability disclosure policy is available online at:
>
>    http://www.zerodayinitiative.com/advisories/disclosure_policy/
>
> Follow the ZDI on Twitter:
>
>    http://twitter.com/thezdi
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/