Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Preemptive Protection against Multiple Vendors librpc.dll Stack Buffer Overflow

Subscribe

Check Point Reference: CPAI-2010-121
Date Published:
Preemptive Since:
Severity:
Source: Secunia Advisory: SA38731
Industry Reference(s): CVE-2009-2754
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
EMC Legato NetWorker 7.x.x

IBM Informix Dynamic Server prior to 10.00.TC9
IBM Informix Dynamic Server prior to 11.10.TC3

Vulnerability Description
A buffer overflow vulnerability exists in IBM's Informix Dynamic Server and EMC's Legato Networker. Informix is a family of relational database management system (RDBMS) products by IBM. The vulnerability is due to insufficient validation of user input during authentication by the RPC protocol parsing library. An attacker can exploit this vulnerability to cause stack based buffer overflow which can lead to arbitrary code execution on the affected system.
Update/Patch Available
At the time of writing, the vendor has not released an advisory addressing this vulnerability.
Vulnerability Details
A stack buffer overflow vulnerability exists in RPC library of IBM Informix port mapper module, librpc.dll. The vulnerability is due to improper bounds checking of the remote procedure call authentication.

Protection Overview

The protection will detect and block attempts to access RPC programs via the portmapper.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?

1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence > RPC, and select the portmap protection group.
3. Click RPC portmap redirect (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?

Upon attack, the following entries will be logged:

Alert Name: Portmap
Description: RPC portmap redirect