CVE-2005-0359 in Storedge Enterprise Backup Software
Summary
by MITRE
The Legato PortMapper in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 does not restrict access to the pmap_set and pmap_unset commands, which allows remote attackers to (1) cause a denial of service by using pmap_unset to un-register a NetWorker service, or (2) obtain sensitive information from NetWorker services by using pmap_set to register a new service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/21/2024
The vulnerability identified as CVE-2005-0359 affects the Legato PortMapper component within several enterprise backup solutions including EMC Legato NetWorker, Sun Solstice Backup, and StorEdge Enterprise Backup versions 6.0 through 7.2. This flaw resides in the authentication and access control mechanisms of the port mapping service that manages service registration and deregistration operations. The vulnerability stems from insufficient authorization checks on critical portmapper commands that should only be accessible to authorized administrative users.
The technical implementation of this vulnerability involves the pmap_set and pmap_unset commands which operate within the portmapper service architecture. These commands are designed to register and unregister network services with the portmapper daemon, but the system fails to properly validate user credentials or enforce access controls before executing these operations. When an unauthenticated remote attacker can execute pmap_unset, they can unregister critical NetWorker services, effectively disrupting backup operations and causing denial of service conditions. Conversely, when an attacker can execute pmap_set, they can register malicious services that may provide unauthorized access to sensitive backup data or system information.
The operational impact of this vulnerability extends beyond simple service disruption to include potential data exposure and system compromise. A remote attacker exploiting this vulnerability can cause significant business disruption by taking down critical backup services essential for data recovery operations. Additionally, the ability to register new services through pmap_set creates opportunities for information disclosure attacks where attackers can gain access to backup service endpoints that may contain sensitive system information, credentials, or backup data. This vulnerability directly maps to CWE-284 (Improper Access Control) and represents a classic example of insufficient authorization checks in network services.
From an attack perspective, this vulnerability demonstrates the importance of implementing proper authentication mechanisms for all administrative operations within network services. The ATT&CK framework categorizes this as a privilege escalation and persistence technique where attackers can manipulate service registration to either disrupt operations or gain unauthorized access to sensitive information. The vulnerability affects systems where the portmapper service is accessible over the network without proper authentication, creating an attack surface that can be exploited by remote adversaries. Organizations should consider implementing network segmentation, firewall rules, and mandatory access controls to prevent unauthorized access to these critical service management interfaces.
Mitigation strategies should include implementing strong authentication mechanisms for portmapper operations, restricting network access to administrative services, and applying appropriate network segmentation to limit exposure. System administrators should also consider disabling unnecessary services, implementing monitoring for unauthorized service registration attempts, and ensuring that backup systems are properly configured with appropriate access controls. The vulnerability underscores the need for regular security assessments of enterprise backup solutions and highlights the importance of maintaining up-to-date security patches for all network services. Organizations should also implement intrusion detection systems to monitor for suspicious portmapper activity and establish incident response procedures for handling potential exploitation attempts.