Update Protection against Sun Solaris sadmind RPC Request Integer Overflow

Vulnerability
Protection

Check Point Reference:	CPAI-2009-093
Date Published:
Severity:
Last Updated:
Source:	Secunia Advisory: SA32473
Industry Reference(s):	CVE-2008-3869 CVE-2008-3870
Protection Provided by:	Security Gateway R70 VPN-1 NGX R65 VSX NGX R65 IPS-1 IPS-1 IPS-1 NGX R65
Who is Vulnerable? Sun Microsystems Solaris 8 Sun Microsystems Solaris 9
Vulnerability Description An integer overflow vulnerability was reported in the sadmind service within the Sun Solaris operating system. sadmind is a daemon used to control servers running Sun Solaris operating system. The vulnerability is triggered when parsing crafted RPC requests. A remote unauthenticated attacker can leverage this vulnerability by sending a crafted RPC message to the target host, to potentially inject and execute arbitrary code.

Update/Patch Available The vendor, Sun Microsystems, has released an advisory addressing this vulnerability: http://sunsolve.sun.com/search/document.do?assetkey=1-66-259468-1
Vulnerability Details The vulnerability resides in the calculation of a buffer allocation size while parsing specially crafted RPC requests. This can be exploited to cause a heap-based buffer overflow via a specially crafted RPC request.

Protection Overview
This protection will detect and block RPC requests to the sadmind program that contain certain invalid header values.

In order for the protection to be activated, update your Security Gateway/VPN-1 product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

Users of IPS-1 are already protected against the CVE-2009-3869 vulnerability if the protection for blocking malformed Sun Solaris sadmind RPC requests in the Protection section of CPAI-2009-091 has been applied.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > SUN-RPC.
2. In the right pane, double-click the Sun Solaris sadmind RPC Request Buffer Overflow protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

CVE-2009-3869
Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solaris sadmind RPC request buffer overflow

CVE-2009-3870
Attack Name: SUN-RPC Enforcement Protection
Attack Information: Sun Solaris sadmind RPC request integer overflow

VPN-1 NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > SUN-RPC > Sun Solaris sadmind RPC Request Buffer Overflow.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

VPN-1 VSX NGX R65

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence RPC, and select the sadmind protection group.
3. Click CVE-2008-3870 RPC sadmind integer overflow (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: Sadmind
Description: CVE-2008-3870 RPC sadmind integer overflow

Legal Notice for Threat Center Advisories