Rule:--Sid:2045--Summary:The snmpXdmi daemon is used on Sun Solaris systems to map Simple NetworkManagement Protocol (SNMP) management requests to and from the Desktop Management Interface (DMI).This daemon contains a boundary condition error that could result in a buffer overflow that will present the attacker with super user access tothe target host.--Impact:Complete control of the target machine.--Detailed Information:The snmpXdmi daemon is installed and enabled by default on the affected systems below.DMI is used to manage components on client machines across a network. Itcan be used in conjunction with SNMP via a daemon such as snmpXdmi.A number of exploits for this vulnerability exist and are in use. The result of a sucessful attack is a complete root compromise of the victim host.Compromised systems are reported to display a number of commonalities such as:	A core file for snmpXdmi on /	Two instances of inetd running	Telnet and SSH backdoors running on high ports	An instance of an IRC proxy	System binaries replaced by rootkit versions	Network sniffers installed	Log files changedThe system binaries 'ps' and 'netstat' cannot be trusted to show all running processes since they may have been replaced by rootkit versions specially modified so as to hide evidence of the compromise.--Affected Systems:Sun Solaris 2.6, 7.0, 8.0 for SPARC and Intel architectures--Attack Scenarios:The attacker must send specially crafted packets to the snmpXdmi daemon or use one of the widely available exploits.--Ease of Attack:Simple--False Positives:None Known--False Negatives:None Known--Corrective Action:Disable the snmpXdmi service.Apply the appropriate patches for each affected system.Disallow all RPC requests from external sources and use a firewall to block access to RPC ports from outside the LAN.--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:Bugtraq:http://www.securityfocus.com/bid/2417CERT:http://www.cert.org/advisories/CA-2001-05.htmlhttp://www.kb.cert.org/vuls/id/648304CVE:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0236--