‘HP, IBM, Sun Calendar Manager RPC Service Code Execution Vulnerability’

Summary

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Calendar Manager RPC Service.’

Credit:

‘The information has been provided by Rodrigo Rubira Branco.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-11-062/


Details

Vulnerable Systems:
 * Hewlett-Packard HP-UX
 * IBM AIX
 * Sun Microsystems Solaris 10

Authentication is not required to exploit this vulnerability.

The specific flaw exists within the CMSD server (rpc.cmsd) which listens by default on UDP port 32768. The process does not properly handle large XDR-encoded ASCII strings to RPC call 10 followed by RPC call 6. This can be abused by an attacker to overflow a buffer on the remote host. Successful exploitation can result in arbitrary code execution.

Patch Availability:
HP:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02702395

IBM:
http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc
IBM is not providing credits, as our system at that time and for this brand does not accept credits.

Oracle:
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

CVE Information:
CVE-2010-4435

Disclosure Timeline:
2009-08-20 – Vulnerability reported to vendor
2011-02-08 – Coordinated public release of advisory’

Categories: News