topic Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow in Operating System - HP-UX

How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Eric Unix — Mon, 02 Mar 2009 01:35:16 GMT

Hello all :

How to Block RPC Services ( Port 111 ) to avoid buffer overflow .
Thanks for your kind input. :-)

BR
eric

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Dennis Handly — Mon, 02 Mar 2009 17:20:02 GMT

It might be better to get a fix for this problem.

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

rick jones — Tue, 03 Mar 2009 01:41:25 GMT

Avoid what _sort_ of buffer overflow?

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Eric Unix — Tue, 03 Mar 2009 01:53:56 GMT

Hello Rick

Thanks your input.
I just know I need to " Block RPC Services ( Port 111 ) to avoid buffer overflow " .
But, i cannot understand your question, would you give more information about it .
thanks a lot.

Best Regards
Eric

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

rick jones — Tue, 03 Mar 2009 02:06:47 GMT

You need to get the person telling you to do this to give a bit more explanation as to what sort of buffer overflow is taking place. Otherwise, there is little to no guarantee that disabling RPC will "solve" the problem and every chance it might break something.

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Laurent Menase — Tue, 03 Mar 2009 10:19:55 GMT

IPfilter

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Armin Kunaschik — Tue, 03 Mar 2009 13:15:14 GMT

If your services don't need RPC then simply don't start it! That means you have to completely disable NFS, autofs, NIS etc via /etc/rc.config.d/nfsconf|namesrvs...
A running rpcbind was usually activated because any service depends on it!
See "rpcinfo -p localhost" for registered services".

If you use NFS (either client or server) or any other RPC sercvice, you can't disable portmapper (rpcbind).

My 2 cents,
Armin

PS: Assign points if you find answers useful!

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Laurent Menase — Tue, 03 Mar 2009 13:49:30 GMT

Else what buffer overflow are you speaking about?

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Avinash20 — Tue, 03 Mar 2009 14:01:21 GMT

If you are using NFS, you cannot block 111 since it is a critical service which is needed

If you like to disable it, stop nfs.client and nfs.server

or

cat /etc/services| grep 111
portmap 111/tcp sunrpc # SUN Remote Procedure Call
portmap 111/udp sunrpc #

Comment the above two entries..

But we like to know why you like to block it.

## You could also block the port on the Firewall.

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Eric Unix — Wed, 11 Mar 2009 00:52:41 GMT

Hello All

Thanks for all of your kind input.
We recently have a security audit, so need to do this action. But, we seems still need this RPC service, so have any method to explain it to say the " RPC " service is safe ?

Thanks a lot.

BR
eric

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Laurent Menase — Thu, 12 Mar 2009 08:04:04 GMT

If you want stamped paper you'll need to contact hp support.

Else for already known security problems, all the communication is made through Security bulletins. - for instance there is once for ONC on 11.31, be sure to have ONC 11.31.06 installed-

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

T G Manikandan — Thu, 12 Mar 2009 08:55:14 GMT

What OS are you talking about?

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Eric Unix — Thu, 12 Mar 2009 08:58:51 GMT

Hello All

1.My OS is hp unix 11.11 and hp unix 11.23
2. Does there are any patch to fix it ?

BR
eric

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Laurent Menase — Thu, 12 Mar 2009 09:02:45 GMT

I am not aware of any known problem there on 11.11 and 11.23.

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

T G Manikandan — Thu, 12 Mar 2009 09:15:03 GMT

I think you are talking about

http://www.cert.org/advisories/CA-2002-26.html

Please check.

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Laurent Menase — Thu, 12 Mar 2009 09:20:54 GMT

The only recent problem is
HPSBUX02375 SSRT080122
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01570585

Re: How to Block RPC Services ( Port 111 ) to avoid buffer overflow

Shailendran V Naidu — Thu, 12 Mar 2009 11:16:18 GMT

Hi Eric,
I think the reason you are trying to block RPC Port 111 is to avoid a Buffer overflow.
But this kind of Vulnerability is in Microsoft Windows and not in HP-UX.

See:
http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx

and

http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx

Please verify with your Security auditor or Admin if they are providing the right advise for the Right Operating systems.

This after all may just be a confusion.