When a client wishes to make an RPC call to a given program number, it first contacts rpcbind on the server machine to determine the address where RPC requests should be sent. The vulnerability has been stated before. Yet, some vendors still have not come up with a sound solution. Rpcbind permits a remote attacker to insert and delete entries without superuser status by spoofing a source address. Ironically, it inserts the entries as being owned by superuser.
Consequences are terrible, to say the least.
The result, much to our surprise, was positive. Both entries have been remotely deleted by an unauthorized third party. Bad router hygiene will lead to problems. If the problem persists, contact your local vendor for an rpcbind replacement or update. Legal terms .