Tutorial - espd vulnerability

##
espd vulnerability

Created 5/9/01
CVE 2001-0331

### Impact

A vulnerability in `rpc.espd` could allow a remote attacker to execute arbitrary commands with root privileges.

### Background

The SGI Embedded Support Partner (ESP) subsystem helps administrators of large networks with configuration management, event management, and resource management. The ESP server (`rpc.espd`) is enabled by default on IRIX operating systems.

### The Problem

Due to a buffer overflow condition, it is possible for an attacker to overwrite the stack pointer in `rpc.espd`, thus gaining the ability to execute arbitrary commands on the system. Since `rpc.espd` is installed as root, the arbitrary commands are executed with root privileges. All versions of `rpc.espd` on IRIX versions 6.5.5 through 6.5.8 are vulnerable unless a patch has been applied.

### Resolution

Disable the `rpc.espd` service if it is not needed. This can be done by removing the execute privileges from the program. Follow these steps:

1. `su` (enter the root password)
2. `chmod -x /usr/etc/rpc.espd`
3. `killall -HUP inetd`

If `rpc.espd` is needed, then apply security patch 4123.

### Where can I read more about this?

More about this vulnerability, including patch information, can be found in X-Force Advisory 76 and in SGI Security Advisory 20010501-01-P.