1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
Rule:
--
Sid:
1957
--
Summary:
This event is generated when an attempt is made to ping the Remote Procedure Call (RPC) sadmind.
--
Impact:
Intelligence gathering activity. The sadmind ping will verify if the daemon is running.
--
Detailed Information:
The sadmind RPC service is used by Solaris Solstice AdminSuite applications to perform remote distributed system administration tasks such as adding new users. The ping function associated with the sadmind daemon will verify if it is active.
--
Affected Systems:
All systems running sadmind.
--
Attack Scenarios:
An attacker can ping the sadmind daemon to verify if it is active. There are several exploits associated with this daemon.
--
Ease of Attack:
Simple.
--
False Positives:
None Known.
--
False Negatives:
None Known.
--
Corrective Action:
Limit remote access to RPC services.
Filter RPC ports at the firewall to ensure access is denied to RPC-enabled machines.
Disable unneeded RPC services.
--
Contributors:
Original rule written by Brian Caswell <bmc@sourcefire.com>
Sourcefire Research Team
Judy Novak <judy.novak@sourcefire.com>
--
Additional References:
Bugtraq
http://www.securityfocus.com/bid/866
--
|
