A remote code execution vulnerability exists in Apache Log4j < 2.15.0 due to insufficient protections on message lookup substitutions when dealing with user controlled input. A remote, unauthenticated attacker can explolit this, via a web request to execute arbitrary code with the permission level of the running Java process.

Nessus was able to execute shellcode and run a system command on the remote Solaris host. Solaris 6, 7, 8, 9, and 10 are affected by a remote code execution vulnerability in the XDR RPC service due to an overflow condition caused by improper validation of user-supplied input when handling RPC requests. An unauthenticated, remote attacker can exploit this, via a specially crafted RPC request, to execute arbitrary code.

EBBISLAND / EBBSHAVE is one of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/08 by a group known as the Shadow Brokers.

The JetBrains TeamCity agent running on the remote host is affected by a remote command execution vulnerability due to the agent behaving as a bidirectional agent even when the unidirectional protocol is enabled. An unauthenticated, remote attacker can exploit this to execute commands via the XML-RPC port, resulting in the disclosure of sensitive information, a denial of service condition, or the execution of arbitrary shell commands.

The RPC portmapper running on the remote host (possibly included with EMC Legato Networker, IBM Informix Dynamic Server, or AIX) has an access restriction bypass vulnerability.

The service will only process pmap_set and pmap_unset requests that have a source address of '127.0.0.1'.  Since communication is performed via UDP, the source address can be spoofed, effectively bypassing the verification process.  This allows remote, unauthenticated attackers to register and unregister arbitrary RPC services.

A remote attacker could exploit this to cause a denial of service or eavesdrop on process communications.

The RPC portmapper is running on this port. 

The portmapper allows someone to get the port number of each RPC service running on the remote host by sending either multiple lookup requests or a DUMP request.

This service answered to a RPC procedure #0 call.

For whatever reason, it was not registered by the portmapper or Nessus could not query to the portmapper (e.g. if port 111 is filtered or not scanned).

This service answered to a RPC procedure #0 call.

For whatever reason, it was not registered by the portmapper or Nessus could not query to the portmapper (e.g.  if port 111 is filtered or not scanned).

A VxWorks WDB Debug Agent is running on this host. 

Using this service, it is possible to read or write any memory zone or execute arbitrary code on the host.  An attacker can use this flaw to take complete control of the affected device.

The remote NFS server is exporting one or more shares without restricting access (based on hostname, IP, or IP range).

The remote NFS server is not exporting any shares.  Running an unused service unnecessarily increases the attack surface of the remote host.

ypupdated is part of NIS and allows a client to update NIS maps.

This old command execution vulnerability was discovered and fixed in 1995. However, it is still possible to run ypupdated in insecure mode by adding the '-i' option.
Anybody can easily run commands as root on this machine by specifying an invalid map name that starts with a pipe (|) character. Exploits have been publicly available since the first advisory.

The RPC portmapper is running on this port.

The portmapper allows someone to get the port number of each RPC service running on the remote host by sending either multiple lookup requests or a DUMP request. 

This service should only run on port 111. However on some operating systems it also listens on different UDP ports. This might allow an attacker to circumvent firewall rules.

Nessus was either able to mount some of the NFS shares exported by the remote server or disclose potentially sensitive information such as a directory listing. An attacker may exploit this issue to gain read and possibly write access to files on remote host.

Note that root privileges were not required to mount the remote shares since the source port to mount the shares was higher than 1024.

This script fetches the remote NIS 'passwd.byname' map, provided that the NIS domain name could be obtained.

Using the remote bootparamd service, it was possible to obtain the NIS domain of the network.  A remote attacker could use this information to mount further attacks.

This script determines whether or not the nibindd rpc service is running, in which case it connects to it to extract the list of NetInfo domains the remote host is serving.

The remote rpc.mountd daemon is vulnerable to an off-by-one overflow which could be exploited by an attacker to gain a root shell on this host.

The RPC library has an integer overflow in the function xdrmem_getbytes(). 

An attacker may use this flaw to execute arbitrary code on this host with the privileges your RPC programs are running with (typically root), by sending a specially crafted request to them. 

Note that this issue affects Solaris, as well as Red Hat Enterprise Linux and Fedora.

Nessus used this flaw to crash the portmapper.

The remote Sun rpc.cmsd has integer overflow problem in xdr_array. An attacker may use this flaw to execute arbitrary code on this host with the privileges rpc.cmsd is running as (typically, root), by sending a specially crafted request to this service.

The remote RPC portmapper forwards NFS requests made to it.

An attacker may use this flaw to make NFS mount requests which will appear to come from localhost and therefore override the ACLs set up for NFS.

The remote NFS server allows users to use a 'cd ..' command to access other directories besides the NFS file system.

An attacker may use this flaw to read every file on this host.

At least one of the NFS shares exported by the remote server could be mounted by the scanning host.  An attacker may be able to leverage this to read (and possibly write) files on remote host.

Note: Shares protected by an ACL that includes the IP of the Nessus host will not be tested.

The remote NFS server might allow an attacker to guess the NFS filehandles, and therefore allow them to mount the remote filesystems without the proper authorizations.

The remote RPC service 100300 (nisd) is vulnerable to a buffer overflow attack that allows any user to obtain a root shell on this host.

The rusersd RPC service is running.  It provides an attacker interesting information such as how often the system is being used, the names of the users, and more.

The remote RPC service #100009 (yppasswdd) is vulnerable to a buffer overflow which allows any user to obtain a root shell on this host.

Note: This issue is different than the one described in CVE-2002-0357 / SGI advisory #20020601-01-P.

The rpc.walld RPC service is running. Some versions of this server allow an attacker to gain root access remotely, by consuming the resources of the remote host then sending a specially formed packet with format strings to this host.

Solaris 2.5.1, 2.6, 7, 8 and 9 are vulnerable to this issue. Other operating systems might be affected as well.

Nessus did not check for this vulnerability, so this might be a false positive.

The remote statd service could be brought down with a format string attack - it now needs to be restarted manually.

This means that an attacker may execute arbitrary code thanks to a bug in this daemon.

This plugin retrieves the list of NFS exported shares.

The remote host is an NIS (Network Information Service) server.  NIS is used to share usernames, passwords, and other sensitive information among the hosts claiming to be within a given NIS domain and passes this information over the network unencrypted.

The bootparamd RPC service is running.  It is used by diskless clients to get the necessary information needed to boot properly.

If an attacker uses the BOOTPARAMPROC_WHOAMI and provides the correct address of the client, then he will get its NIS domain back from the server. Once the attacker discovers the NIS domain name, he may easily get your NIS password file.

The tooltalk RPC service is running.

A possible implementation fault in the ToolTalk object database server may allow an attacker to execute arbitrary commands as root.

*** This warning may be a false positive since the presence of this
*** vulnerability is only accurately identified with local access.

The remote host is running the rstatd RPC service. This service provides information such as :

 - the CPU usage
 - the system uptime
 - the network usage

The rquotad RPC service is running.  If you do not use this service, then disable it as it may become a security threat in the future, if a vulnerability were to be discovered.

The RPC portmapper is running on this port.

The portmapper allows someone to get the port number of each RPC service running on the remote host by sending either multiple lookup requests or a DUMP request.

The etherstatd RPC service is running. If you do not use this service, then you should disable it as it may become a security threat in the future, if a vulnerability is discovered.

The database RPC service is running. If you do not use this service, then you should disable it as it may become a security threat in the future, if a vulnerability is discovered.

The alis RPC service is running. If you do not use this service, then you should disable it as it may become a security threat in the future, if a vulnerability is discovered.

The 3270 mapper RPC service is running. If you do not use this service, then you should disable it as it may become a security threat in the future, if a vulnerability is discovered.

ID	Name	Severity
156559	Apache Log4Shell RCE detection via callback correlation (Direct Check RPCBIND)	critical
103532	Solaris XDR RPC Request Handling RCE (April 2017 CPU) (EBBISLAND / EBBSHAVE)	critical
94675	JetBrains TeamCity Agent XML-RPC Port RCE	critical
54586	Multiple Vendor RPC portmapper Access Restriction Bypass	medium
53335	RPC portmapper (TCP)	info
53334	Detect RPC over UDP	info
53333	Detect RPC over TCP	info
48264	VxWorks WDB Debug Service Detection	critical
42256	NFS Shares World Readable	high
42255	NFS Server Superfluous	info
31683	Multiple Vendor NIS rpc.ypupdated YP Map Update Arbitrary Remote Command Execution	high
20759	RPC rpcbind Non-standard Port Assignment Filter Bypass	medium
15984	NFS Share User Mountable	high
12238	NIS passwd.byname Map Disclosure	medium
12237	RPC bootparamd NIS Domain Name Disclosure	medium
11899	RPC nibindd Service Detection	medium
11800	Linux NFS utils package (nfs-utils) mountd xlog Function Off-by-one Remote Overflow	critical
11420	Sun RPC XDR xdrmem_getbytes Function Remote Overflow	critical
11418	Sun rpc.cmsd Remote Overflow	critical
11358	NFS portmapper localhost Mount Request Restricted Host Access	high
11357	Multiple Vendor NFS CD Command Arbitrary File/Directory Access	medium
11356	NFS Exported Share Information Disclosure	critical
11353	NFS Predictable Filehandles Filesystem Access	medium
10251	Multiple Vendor rpc.nisd Long NIS+ Argument Remote Overflow	high
11058	RPC rusers Remote Information Disclosure	medium
11021	IRIX rpc.yppasswdd Unspecified Remote Overflow	high
10950	Solaris rpc.rwalld Remote Format String Arbitrary Code Execution	high
10544	Linux Multiple statd Packages Remote Format String	critical
10437	NFS Share Export List	info
10158	NIS Server Detection	info
10031	RPC bootparamd Service Information Disclosure (Deprecated)	medium
10239	CDE RPC tooltalk Service Multiple Overflows	critical
10227	RPC rstatd Service Detection	info
10226	rquotad Service Detection	info
10223	RPC portmapper Service Detection	info
10215	RPC etherstatd Service Detection	info
10214	RPC database Service Detection	info
10210	RPC alis Service Detection	info
10208	3270 Mapper Service Detection	info

Detections

Analytics

RPC Family for Nessus

critical

critical

critical

medium

info

info

info

critical

high

info

high

medium

high

medium

medium

medium

critical

critical

critical

high

medium

critical

medium

high

medium

high

high

critical

info

info

medium

critical

info

info

info

info

info

info

info