Vulnerability Note VU#648304

Sun Solaris DMI to SNMP mapper daemon snmpXdmid contains buffer overflow

The snmpXdmi daemon contains a buffer overflow in the code for translating DMI indications to SNMP events. This buffer overflow is exploitable by remote intruders to gain root privileges.

More information about this vulnerability can be found in the advisory published by Job de Haas of ITSX:

http://www.itsx.com/snmpXdmid.html

Apply a patch from Sun when it is available.

Disable snmpXdmi

Sites that do not use both SNMP and DMI should disable the translation daemon, thus eliminating the vulnerability.

Restrict Access to snmpXdmi and other RPC services

Sites that require the functionality of snmpXdmi or other RPC services should restrict access through filtering. Local IP filtering rules that prevent hosts other than localhost from connecting to the daemon may mitigate the risks associated with running the daemon. Sun RPC services are advertised on port 111/{tcp,udp}. The snmpXdmid RPC service id is 100249; use 'rpcinfo -p' to list local site port bindings:

# rpcinfo -p | grep 100249
  100249 1 udp 32785
  100249 1 tcp 32786

Note that site-specific port binding will vary.

Systems Affected

http://www.itsx.com/snmpXdmid.html
http://www.securityfocus.com/bid/2417
http://www.securityfocus.com/archive/1/168936
http://www.sun.com/software/entagents/download/
http://www.sun.com/software/entagents/docs/UGhtml/snmp_with_dmi.doc.html
http://www.dmtf.org/spec/spec.html
http://www.dmtf.org/spec/snmp.html
http://www.ciac.org/ciac/bulletins/l-065.shtml

Credit

Thanks to Job de Haas (job@itsx.com) of ITSX BV Amsterdam, The Netherlands (http://www.itsx.com) for reporting this vulnerability to the CERT/CC.

This document was written by Cory F. Cohen.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.