OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq Archives: Exploit of rpc.cmsd

Exploit of rpc.cmsd

Bob Todd (toddrARC.COM)
Fri, 9 Jul 1999 08:25:31 -0400

The calendar manager (rpc.cmsd) on Solaris 2.5 and 2.5.1 is vulnerable
to a buffer overflow
attack. Further, it appears that even patched versions may be
vulnerable. Also, rpc.cmsd under
Solaris 2.6 could also be problematic. Where possible, it should be
disabled in inetd.conf

The exploit allows for remote root access where we have seen the
intruder delete administrator
logs, change homepages, and insert backdoors. The attack signature is
similar to the tooltalk attack.

begin 666 Bob Todd.vcf
M0D5'24XZ5D-!4D0-"E9%4E-)3TXZ,BXQ#0I..E1O9&0[0F]B#0I&3CI";V(
M5&]D9 T*3U)'.D%D=F%N8V5D(%)E<V5A<F-H($-O<G!O<F%T:6]N#0I4251,
M13I#:&EE9B!%;F=I;F5E<T*3D]413M%3D-/1$E.1SU154]4140M4%))3E1!
M0DQ%.DUA<GEL86YD($]F9FEC93H],$0],$$(" (%!H;VYE.B *#,P,2D
M.#4U+M.#4U+3S,#4],$0],$$],$0],$%$97!L;WEE9"!A8F]A<F0]#0H=&AE($IU
M;&M;&424E).CTP1#TP02 (" 4&AO;F4Z(" H-S S*2 R,#$M.#(R,B H26YL
M86YD(&%N9"!.96%R($-O87-T86PI/0T*/3!$/3!!(" ("!62$8Z(" ("!7
M0U4,3<S-2 H26YL86YD(&%N9"!.96%R($-O87-T86PI/3!$/3!!(" ("!3
M4T(Z(" ("!70ST-"E4,3<S-2 H2&EG:"!396%S*3TP1#TP00T*5$5,.U=/
M4DL[5D])0T4Z*#<P,M4DL[5D])0T4Z*#<P,RD.3,X+30S.#4-"E1%3#M73U)+.U9/M4DL[5D])0T4Z*#<P,RD.3,X+30S.#4-"E1%3#M73U)+.U9/24-%.BW,#,I
M(#(P,RTP.#4U#0I414P[4$%'15([5D])0T4Z*#<P,RD,C S+3 X-34-"E1%
M3#M73U)+.T9!6#HH-S S*2 Y,M3#M73U)+.T9!6#HH-S S*2 Y,SM-#,X-0T*0412.U=/4DL[14Y#3T1)3D<]
M455/5$5$+5!224Y404),13H[5FER9VEN:6$[4$\0F]X(#<T-3TP1#TP03M6
M:65N;F$[5D$[,C(Q.# [55-!#0I,04)%3#M73U)+.T5.0T]$24Y'/5%53U1%
M1"U04DE.5$%"3$4Z5FER9VEN:6$],$0],$%03R!";W-S0U/3!$/3!!/3!$
M/3!!5FEE;FYA+"!602 R,C$X,#TP1#TP055300T*55),M/3!!5FEE;FYA+"!602 R,C$X,#TP1#TP055300T*55),.T*55),.FAT=' Z
M+R]W=W<N87)C+F-O;0T*M+R]W=W<N87)C+F-O;0T*2T59.UU,#D[14Y#3T1)3D<]M+R]W=W<N87)C+F-O;0T*2T59.UU,#D[14Y#3T1)3D<]0D%3138T.T*("
M($U)24-6:D-#06=!0T%7.'=$45E*2V]:26AV8TY!445%0E%!=V=C:WA#>D%*
M0F=.5D)!651!;%9435)%=T1W641645%)17=H5PT*(" (&%82FYA5S5P651%
M4$U!,$=!,55%0GA-1U9M;&QB;35H35-9=TI!641645%+M4$U!,$=!,55%0GA-1U9M;&QB;35H35-9=TI!641645%+17Q0EI(6FAB;4YL
M6D-"4UI83FQ96$IJ84-"1 T*(" (&(S2G=B,TIH9$=L=F)J16Q-0TU'03%5
M14-X36-4;58P8S).:&-'56=1,CET8T=&,&%72G!B1VPP95-"2&-M.3%C1$5P
M34-C1PT*(" ($$Q545!>$UG45=2,EE7-6I:5U%G56U6>EI71GE9,F=G43(Y
M>6-'.7E96%)P8C(T9U$P17A(1$%A0F=K<6AK:4<Y=S!"0U%%5PT*(" ($18
M4G9:1U)Y44=&>5EY-6IB,C!W2&AC3D]49W=.5$$U341)>4]44317:&-.3U1K
M>$UJ37=-1$EY3U11-%=J0T)O5$5,34%K1PT*(" ($$Q545":$U#5E9->$54
M05!"9TY60D%G5$-&6DI5:V1*5&ML0DU2.'=(45E$5E%12T5X6D):2%IH8FU.
M;%I#0E-:6$YL65A*:T*(" (&%#0D1B,TIW35-9=TI!641645%,M;%I#0E-:6$YL65A*:T*(" (&%#0D1B,TIW35-9=TI!641645%,17Q3F%7
M3GEB,TYV6FY19U$R.71C1T8P85=*<&)';#!E4T)(8VTY,6-$15E-0EE'03%5
M10T*(" ($%X35!1;3EI2492=EI'46=96%%G459*1$U2=W='9UE*2V]:26AV
M8TY!46M"1F<Q,&(R4FMC:T)H8VU-=5DR.71-1G=M8TY!46M"1F<Q,&(R4FMC:T)H8VU-=5DR.71-1G=W1%%92T*(" ($MO6DEH
M=F-.05%%0D)10413=T%W4T%*0D%.8FTU=T=0:D=E1V%J5$YL9$,R1#A+=CEF
M56YD8E15>EI&>FU3,$M*:U!L,C)F, T*(" (&IW9S=,,FY84&%&<'I"5VMF
M=4)M>7=#4D5(5&Y)+S!G=RM-6BM':T-!=T5!051!3D)G:W%H:VE'.7<P0D%1
M449!04Y"M449!04Y"04V00T*(" ($Y5:G5M475!9W1Y3'4V6G<K34]U64UD<VUE;C1M
M46U-;E5-6GAQ<'-70V(U87I#6F-32D93;49Q0S1M5' O1&%K55IM5U(X+PT*
M(" ('-);')84T1I1C,X/0T*#0H-"D5-04E,.U!2148[24Y415).150Z=&]D
M9') 87)C+F-O;0T*4D56.C$Y.3DP-S Y5#$R,C4S,5H-"D5.1#I60T%21 T*
`
end

This archive was generated by hypermail 2.0b3 on Thu Jul 08 1999 - 19:56:50 CDT