Vulnerability record · CVE-2001-0779 · published 18 October 2001
CVE-2001-0779: Solaris rpc.yppasswdd Buffer Overflow Allows Remote Root
Sun · Solaris
rpc.yppasswdd, the NIS yppasswd server in Solaris 2.6, 7 and 8, contains a buffer overflow triggered by a long username. Because the daemon runs with elevated privileges, a successful overflow gives the attacker root on the host. The flaw is remotely reachable and requires no authentication.
Description
Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote code execution as root with a CVSS 2.0 score of 10 and high EPSS probability makes this an urgent fix despite the age of the platform.
What it is
rpc.yppasswdd, the NIS yppasswd server in Solaris 2.6, 7 and 8, contains a buffer overflow triggered by a long username. Because the daemon runs with elevated privileges, a successful overflow gives the attacker root on the host. The flaw is remotely reachable and requires no authentication.
Impact
An unauthenticated remote attacker can execute code as root, leading to full compromise of the Solaris host and any NIS domain data it serves.
Attack surface
Reached over the network via RPC to the yppasswdd service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.62188 (99.1st percentile) and multiple references carry the Exploit tag, indicating public exploit code exists.
What to do
- Apply the Sun/Solaris security patch referenced in Sun Security Bulletin 209 (and vendor advisory links) to affected Solaris 2.6, 7 and 8 systems.
- If yppasswdd is not required, disable the service and block RPC portmapper access to it.
- Restrict network access to the yppasswdd RPC port using host firewalls or tcp_wrappers so only trusted NIS clients can reach it.
- Where the service must remain, run it under a least-privilege account rather than as root if the platform permits.
- Monitor vendor and CERT/CC advisories for updated guidance on this legacy platform.
Detection
- Inspect yppasswdd and RPC logs for unusually long username strings or malformed yppasswd requests.
- Alert on unexpected child processes or shell spawns originating from the rpc.yppasswdd process.
- Monitor for new listening services, modified system binaries, or root-level file changes on NIS servers.
- Use network IDS signatures for oversized RPC yppasswd username payloads.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2001-0779 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2001-0779), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
