Multiple Vendor rpc.yppasswdd Buffer Overrun Vulnerability

Multiple Vendor rpc.yppasswdd Buffer Overrun Vulnerability

Solution:
It is recemmended that this service is disabled until patches are available. If this is not an option, network access control should be implemented blocking access to ports that rpc.yppasswdd might use.

Customers of HP-UX 10.10 are advised to contact security-alert@hp.com for further information.

HP-UX 10.20 users and admins are advised to download a replacement rpc.yppasswd binary from the following location:

ftp://yppass:yppass@hprc.external.hp.com/
ftp://yppass:yppass@192.170.19.51/

HP-UX 11.00, 11.11, and 11.22 users and admins are advised to apply the follow or subsequent PHNE file:

11.00 - PHNE_28102
11.11 - PHNE_28103
11.22 - PHNE_28138

Further information is available in the referenced advisory.

HP has released a revision of the advisory HPSBUX0302-242 (rev.2). Please see the referenced advisory for more information.

Fixes are available:

Sun Solaris 2.6