RPC: RPC.statd Linux Remote Format String Attack (4)
This signature detects generic format strings in a statd packet. Several implementations of statd are vulnerable to a format string attack. A successful attack can allow a remote attacker to execute arbitrary code on your system with permissions of the statd daemon.
Extended Description
A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux distributions. Because of a format-string vulnerability when calling the 'syslog()' function, a remote attacker can execute code as root. The 'rpc.statd' server is an RPC server that implements the Network Status and Monitor RPC protocol. It's a component of the Network File System (NFS) architecture. The logging code in 'rpc.statd' uses the 'syslog()' function, passing it as the format string user-supplied data. A malicious user can construct a format string that injects executable code into the process address space and overwrites a function's return address, thus forcing the program to execute the code. The 'rpc.statd' server requires root privileges for opening its network socket, but fails to drop these privileges later on. Therefore, code run by the malicious user will execute with root privileges. Debian, Red Hat, and Connectiva have all released advisories. Presumably, any Linux distribution that runs the statd process is vulnerable unless patched for the problem.
Affected Products
Suse linux
Short Name
RPC:RPC.STATD:STATD-FMT-STR4
Severity
Critical
Recommended
False
Recommended Action
Drop
Category
RPC
Keywords
(4) Attack CA-2000-17 CVE-2000-0666 Format Linux RPC.statd Remote String bid:1480
Release Date
06/21/2007
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
Port
RPC/100024
False Positive
Unknown
Vendors
Red_hat
Conectiva
Suse
Debian
Trustix
CVSS Score
10.0