Description
The Legato PortMapper in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 does not restrict access to the pmap_set and pmap_unset commands, which allows remote attackers to (1) cause a denial of service by using pmap_unset to un-register a NetWorker service, or (2) obtain sensitive information from NetWorker services by using pmap_set to register a new service.
References
- VU#801089 third-party-advisory
- legato-portmapper-obtain-information(21893) vdb-entry
- 16470 third-party-advisory
- 16464 third-party-advisory
- 1014713 vdb-entry
- 14582 vdb-entry
- http://www.legato.com/support/websupport/product_alerts/081605_NW_port_mapper.htm
- 18802 vdb-entry
- 101886 vendor-advisory