Title: RPC Portmapper Denial of Sevice Vulnerability
Severity: MODERATE
Description:
RPC 'portmapper' is prone to a denial-of-service vulnerability.
RPC (Remote Procedure Call) allows a program to request a service from a program located in another computer in a network without requiring detailed information on the network configuration.
An attacker capable of forging a 'pmap_set/pmap_unset' UDP packet can cause the remote host to register or unregister arbitrary RPC programs. As a result, the attacker can cause a denial of service by disabling key services on the target host, including 'mountd', 'nfsd', and ypserv.
Because it allows a malicious local user to register RPC programs on the server, depending on the program the attacker chooses to register, this vulnerability can allow a compromise of root privilege, potentially extending to other systems on the local network.
In addition to the affected platforms listed, other versions have yet to be tested and may be vulnerable as well.
Affected Products:
- Linux libc 5.0.9
- Linux libc 5.2.18
- Linux libc 5.3.12
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
