Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Sun Solstice AdminSuite sadmind service adm_build_path Buffer Overflow Vulnerability

Subscribe

Check Point Reference: CPAI-2009-024
Date Published:
Severity:
Source: Secunia Advisory: SA32283
Industry Reference(s): CVE-2008-4556
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
VSX
  • NGX R65
InterSpect
  • NGX
Who is Vulnerable?
Sun Microsystems Solaris 8 (x86, SPARC Platform)
Sun Microsystems Solaris 9 (x86, SPARC Platform)
Vulnerability Description
Solstice AdminSuite is a set of applications for distributed system administration. sadmind is a daemon used by Solstice AdminSuite to control the servers running Sun Solaris operating system. A stack buffer overflow vulnerability has been reported in Solstice AdminSuite's sadmind. A remote attacker may exploit this issue to execute arbitrary code on an affected system.
Vulnerability Details
The vulnerability is due to an error in the Solstice AdminSuite's sadmind that fails to properly validate user input when processing RPC requests. A remote attacker may exploit this vulnerability via a specially crafted RPC message sent to the vulnerable host. Successful exploitation may allow execution of arbitrary code on the target system.

Protection Overview
By enabling this protection, SmartDefense will detect and block malformed SUN-RPC requests sent to the vulnerable service.

In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > SUN-RPC.
2. Select the following protection:

Sun Solstice AdminSuite sadmind service adm_build_path Buffer Overflow

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solstice AdminSuite sadmind service adm_build_path buffer overflow

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > SUN-RPC.
2. Select the following protection:

Sun Solstice AdminSuite sadmind service adm_build_path Buffer Overflow

3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solstice AdminSuite sadmind service adm_build_path buffer overflow

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > SUN-RPC.
2. Select the following protection:

Sun Solstice AdminSuite sadmind service adm_build_path Buffer Overflow

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solstice AdminSuite sadmind service adm_build_path buffer overflow

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > UNIX-RPC.
3. Select the following protection:

Sun Solstice AdminSuite sadmind service adm_build_path Buffer Overflow

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solstice AdminSuite sadmind service adm_build_path buffer overflow