Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Sun Solaris rpc.ypupdated Command Injection Vulnerability

Subscribe

Check Point Reference: CPAI-2008-167
Date Published:
Severity:
Source: SecurityFocus ID: 28383
Industry Reference(s): CVE-1999-0208
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
VSX
  • NGX R65
InterSpect
  • NGX
Who is Vulnerable?
Sun Microsystems Solaris 10 and prior
Vulnerability Description
Sun Solaris provides its Network Information Service (NIS) services through the SUN-RPC remote procedure call mechanism. One of these services is called rpc.ypupdated which is responsible for duplicating information from master NIS server to slave servers. A command injection vulnerability exists in Sun Solaris rpc.ypupdated service. A remote attacker may exploit this issue to execute arbitrary code on an affected system.
Vulnerability Details
The vulnerability is due to an error in the Sun Solaris rpc.ypupdated service that fails to properly validate user input when processing RPC requests. A remote attacker may exploit this vulnerability via a specially crafted RPC request sent to the vulnerable host. Successful exploitation may allow execution of arbitrary code on the target system.

Protection Overview
By enabling this protection, SmartDefense will detect and block malformed RPC requests sent to the vulnerable service.

In order for the protection to be activated, update your VPN-1/InterSpect/Connectra product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Sun-RPC.
2. Select the following protection:

Sun Solaris rpc.ypupdated Command Injection

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solaris rpc.ypupdated command injection

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > SUN-RPC.
2. Select the following protection:

Sun Solaris rpc.ypupdated Command Injection

3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solaris rpc.ypupdated command injection

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Sun-RPC.
2. Select the following protection:

Sun Solaris rpc.ypupdated Command Injection

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solaris rpc.ypupdated command injection

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > UNIX-RPC.
3. Select the following protection:

Sun Solaris rpc.ypupdated Command Injection

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solaris rpc.ypupdated command injection