rpc.sadmind overflow
advICE :Intrusions : 2001722

Summary

An attempt was made to break into the system by executing a "buffer over" attack against the server.

Details

The Solstice Administration service (sadmin) contains buffer overflows in Solaris versions 2.5 through 7. This has become a popular attack in the hacker community. It is a good bet that if you have an unpatched version of Solaris on the Internet that exposes this service, the system will be found and exploited.

The exploit is difficult to get right. Therefore, you often see multiple attempts in a row. The inetd service will automatically restart the service each time the hacker crashes it. The hacker will often attempt to "grind" through many stack-offset combinations until they get that right overflow that runs his/her code. Note that if the hacker tries too fast, it will actually disable the service for a while. Therefore, you'll see usually a few seconds delay between each attempt.

 
Version appeared: 2.1