CVE-2005-0359

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

The Legato PortMapper in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 does not restrict access to the pmap_set and pmap_unset commands, which allows remote attackers to (1) cause a denial of service by using pmap_unset to un-register a NetWorker service, or (2) obtain sensitive information from NetWorker services by using pmap_set to register a new service.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:N/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/16464Patch, Vendor Advisory
http://secunia.com/advisories/16470Vendor Advisory
http://securitytracker.com/id?1014713Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/801089Patch, Third Party Advisory, US Government Resource
http://www.legato.com/support/websupport/product_alerts/081605_NW_port_mapper.htmPatch
http://www.osvdb.org/18802
http://www.securityfocus.com/bid/14582Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21893
http://secunia.com/advisories/16464Patch, Vendor Advisory
http://secunia.com/advisories/16470Vendor Advisory
http://securitytracker.com/id?1014713Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/801089Patch, Third Party Advisory, US Government Resource
http://www.legato.com/support/websupport/product_alerts/081605_NW_port_mapper.htmPatch
http://www.osvdb.org/18802
http://www.securityfocus.com/bid/14582Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21893

Timeline

Published: Aug 23, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-03605.0The Microsoft Log Sink Class ActiveX control in pkmcore.dll is marked as "safe for scripting" for Internet Explorer, which allows remote att CVE-2005-03624.6awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadp CVE-2005-03637.5awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.CVE-2005-03645.0Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service.CVE-2005-03652.1The dcopidlng script in KDE 3.2.x and 3.3.x creates temporary files with predictable filenames, which allows local users to overwrite arbitr CVE-2005-03665.0The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers CVE-2005-03674.6Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read, delete, or upload arb CVE-2005-03687.5Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the (1) EntryID or (2) search CVE-2005-03695.3Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of service (application cra CVE-2005-03705.0Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (network disc CVE-2005-03715.0Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (freeze) via CVE-2005-03725.0Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot