rpc.statd problem and Solaris 8

[nolbu]

Does the rpc.statd problem reported in Security Bulletin 135
( [url]http://sunsolve.sun.com/pub-cgi/retrieve.pl?type=0&doc=secbull%2F135&display=plain[/url]
)
truly affect Solaris 8? An ISS scan reports the problem. What is
the appropriate patch?

Thanks.

[Anthony Mandic]

nolbu wrote:

>
> Does the rpc.statd problem reported in Security Bulletin 135
> ( [url]http://sunsolve.sun.com/pub-cgi/retrieve.pl?type=0&doc=secbull%2F135&display=plain[/url]
> )
> truly affect Solaris 8?

If you read it closely, you'll notice its dated '96. Well before
Solaris 8 came out. Solaris 8 isn't listed in the OS list it
reports so its reasonable to assume that its been fixed.

> An ISS scan reports the problem. What is
> the appropriate patch?

I don't think there is a patch. You could use patchdiag from
SunSolve to check though. What does ISS say exactly?

-am © 2003

[Casper H.S. Dik]

[email]nolbu@my-deja.com[/email] (nolbu) writes:

>Does the rpc.statd problem reported in Security Bulletin 135
> ( [url]http://sunsolve.sun.com/pub-cgi/retrieve.pl?type=0&doc=secbull%2F135&display=plain[/url]
>)
> truly affect Solaris 8? An ISS scan reports the problem. What is
>the appropriate patch?

No, it does not.

It's an ISS false positive.

(I think they assume that the "void" RPC procedure should
return an error in fixed software; it can't)

It's too bad that they can't write their scanning
software conservatively because these false positives
give us a lot of work.

Casper
--
Expressed in this posting are my opinions. They are in no way related
to opinions held by my employer, Sun Microsystems.
Statements on Sun products included here are not gospel and may
be fiction rather than truth.