CVE-1999-0189 in Solaris
Summary
by MITRE
Solaris rpcbind listens on a high numbered UDP port, which may not be filtered since the standard port number is 111.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/16/2026
The vulnerability described in CVE-1999-0189 pertains to the Solaris rpcbind service which operates on high-numbered UDP ports rather than the standard port 111 that is typically associated with the Remote Procedure Call binding service. This deviation from the expected port configuration creates a significant security risk as network administrators and security tools often focus their monitoring and filtering efforts on well-known service ports. The rpcbind service in Solaris systems is responsible for mapping RPC program numbers to network addresses, making it a critical component in distributed computing environments where services need to communicate across network boundaries.
The technical flaw lies in the service's non-standard port binding behavior which bypasses conventional network security measures that typically filter traffic on port 111. When rpcbind listens on high-numbered UDP ports, it becomes more difficult to detect and control through standard firewall rules and intrusion detection systems. This behavior allows malicious actors to potentially exploit the service without triggering typical security alerts, as the traffic appears to originate from random port ranges rather than the expected well-known port 111. The vulnerability is classified under CWE-693 as a Protection Mechanism Failure, specifically involving inadequate port filtering and service visibility.
The operational impact of this vulnerability is substantial as it undermines network security controls and increases the attack surface for Solaris systems. Attackers can leverage this weakness to perform port scanning activities more effectively, as the non-standard port usage makes it harder to identify the service through conventional means. Additionally, the vulnerability can be exploited in conjunction with other network-based attacks, potentially allowing unauthorized access to RPC services that rely on rpcbind for service discovery. The configuration allows for easier exploitation of RPC-related vulnerabilities since the service's presence is less obvious to network monitoring tools and security personnel who typically focus on standard port 111.
Security mitigations for this vulnerability involve implementing comprehensive network monitoring and filtering rules that account for the non-standard port behavior of rpcbind. Organizations should configure firewalls to properly filter traffic on all ports used by rpcbind, rather than relying solely on standard port 111 filtering. The recommended approach includes implementing strict access controls that limit rpcbind's exposure to only trusted networks and hosts. Additionally, network administrators should conduct regular vulnerability assessments to identify services running on non-standard ports and ensure proper security controls are in place. This vulnerability aligns with ATT&CK technique T1046 which involves network service scanning, as the non-standard port usage can mask malicious activities from typical network monitoring systems. System administrators should also consider disabling rpcbind if the service is not required, or implementing additional logging and monitoring to track rpcbind activity on high-numbered ports.