Security readout for executives and security teams
Plain-English summary
This finding flags that an old Unix service called rstatd is running on a system. Rstatd shares performance and uptime details over the network without requiring a login, which can help an attacker learn about the machine. It is not a specific software flaw but a configuration exposure recorded by the CVE program in 1999.
Executive priority
Low priority. Legacy service exposure. Address as part of routine hardening on Unix hosts, not as an emergency change.
Technical view
CVE-1999-0624 records that the rstat/rstatd RPC service is exposed on a host. Rstatd returns kernel and performance statistics over Sun RPC and typically requires no authentication. The bundle lists no CVSS, CWE, or affected product, and is not in KEV. The item is best treated as an unauthenticated information-disclosure and reconnaissance surface rather than a code execution flaw.
Likely exposure
Primarily legacy Unix, Solaris, and BSD systems where rstatd was enabled by default or left on after installation. Exposure is highest on hosts reachable from untrusted networks with RPC portmapper (port 111) accessible. Modern hardened systems typically do not run rstatd.
Exploitation context
Not listed in CISA KEV. The CVE record describes a service exposure rather than a specific memory-corruption or authentication bypass. No cited source in this bundle indicates active exploitation. Historical use cases involved information disclosure about system performance and uptime, which could support reconnaissance rather than direct compromise.
Researcher notes
CVE-1999-0624 is a configuration-class advisory with sparse metadata: no CVSS, no CWE, no vendor, and only the CVE Program reference in the bundle. Treat detections as reconnaissance risk rather than direct compromise. Confirm the RPC program (typically 100001) is registered with portmap before scoping remediation. Modern equivalents rarely surface outside legacy environments.
Mitigation direction
- Disable rstatd via inetd or the system service manager on affected hosts.
- Block RPC portmapper (TCP/UDP 111) and dynamic RPC ports at network boundaries.
- Restrict rstatd to trusted management networks if it must remain enabled.
- Consult vendor guidance for the specific Unix distribution in use.
- Replace rstatd-based monitoring with an authenticated modern telemetry agent.
Validation and detection
- Enumerate RPC services with rpcinfo against suspected hosts to confirm rstatd is registered.
- Check inetd, xinetd, or systemd unit configuration for rstatd or rpc.rstatd entries.
- Review firewall and segmentation rules for exposure of port 111 and RPC dynamic ranges.
- Correlate host inventory against vendor end-of-life documentation for the OS.
- Verify monitoring tooling does not depend on rstatd before disabling it.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0624 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cve.org/CVERecord?id=CVE-1999-0624CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.