How to Block RPC Services ( Port 111 ) to avoid buffer overflow

[Eric Unix]

Hello all :

How to Block RPC Services ( Port 111 ) to avoid buffer overflow .
Thanks for your kind input. :-)

BR
eric

[Dennis Handly]

It might be better to get a fix for this problem.

[rick jones]

Avoid what _sort_ of buffer overflow?

[Eric Unix]

Hello Rick

Thanks your input.
I just know I need to " Block RPC Services ( Port 111 ) to avoid buffer overflow " .
But, i cannot understand your question, would you give more information about it .
thanks a lot.

Best Regards
Eric

[rick jones]

You need to get the person telling you to do this to give a bit more explanation as to what sort of buffer overflow is taking place. Otherwise, there is little to no guarantee that disabling RPC will "solve" the problem and every chance it might break something.

[Laurent Menase]

IPfilter

[Armin Kunaschik]

If your services don't need RPC then simply don't start it! That means you have to completely disable NFS, autofs, NIS etc via /etc/rc.config.d/nfsconf|namesrvs...
A running rpcbind was usually activated because any service depends on it!
See "rpcinfo -p localhost" for registered services".

If you use NFS (either client or server) or any other RPC sercvice, you can't disable portmapper (rpcbind).

My 2 cents,
Armin

PS: Assign points if you find answers useful!

[Laurent Menase]

Else what buffer overflow are you speaking about?

[Avinash20 · Accepted solution]

If you are using NFS, you cannot block 111 since it is a critical service which is needed

If you like to disable it, stop nfs.client and nfs.server

or

cat /etc/services| grep 111
portmap 111/tcp sunrpc # SUN Remote Procedure Call
portmap 111/udp sunrpc #


Comment the above two entries..

But we like to know why you like to block it.

## You could also block the port on the Firewall.

[Eric Unix]

Hello All

Thanks for all of your kind input.
We recently have a security audit, so need to do this action. But, we seems still need this RPC service, so have any method to explain it to say the " RPC " service is safe ?

Thanks a lot.

BR
eric

[Laurent Menase]

If you want stamped paper you'll need to contact hp support.

Else for already known security problems, all the communication is made through Security bulletins. - for instance there is once for ONC on 11.31, be sure to have ONC 11.31.06 installed-

[T G Manikandan]

What OS are you talking about?

[Eric Unix]

Hello All

1.My OS is hp unix 11.11 and hp unix 11.23
2. Does there are any patch to fix it ?


BR
eric

[Laurent Menase]

I am not aware of any known problem there on 11.11 and 11.23.

[T G Manikandan]

I think you are talking about

http://www.cert.org/advisories/CA-2002-26.html

Please check.

[Laurent Menase]

The only recent problem is
HPSBUX02375 SSRT080122
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01570585

[Shailendran V Naidu]

Hi Eric,
I think the reason you are trying to block RPC Port 111 is to avoid a Buffer overflow.
But this kind of Vulnerability is in Microsoft Windows and not in HP-UX.

See:
http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx

and

http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx


Please verify with your Security auditor or Admin if they are providing the right advise for the Right Operating systems.

This after all may just be a confusion.