Security readout for executives and security teams
Plain-English summary
This entry flags that the RPC portmapper service is running on a host. Portmapper helps clients find network services on Unix-like systems, but exposing it to untrusted networks lets attackers enumerate available services and can aid reconnaissance or amplification attacks. It is a configuration exposure rather than a specific software flaw.
Executive priority
Low priority as an isolated finding. Treat it as configuration hygiene that reduces reconnaissance surface, and prioritize higher when the affected host runs NFS, is internet-facing, or supports regulated workloads.
Technical view
CVE-1999-0632 records that the RPC portmapper (rpcbind, port 111/TCP and UDP) is running and reachable. Portmapper maps RPC program numbers to network ports, allowing enumeration of registered RPC services such as NFS, NIS, and rstatd. When exposed externally, it supports service discovery for follow-on attacks and, historically, has been abused for UDP reflection.
Likely exposure
Any Unix, Linux, or Solaris system running rpcbind/portmap with port 111 reachable from untrusted networks is exposed. Legacy servers, NFS hosts, and misconfigured perimeter firewalls are the common cases. The source bundle does not name specific vendors or versions.
Exploitation context
The CVE record does not indicate active exploitation and it is not listed in CISA KEV. The entry describes an exposure condition, not a code-execution vulnerability. Attackers historically use portmapper for RPC service enumeration and UDP reflection, but no exploitation status is asserted by the provided sources.
Researcher notes
The CVE entry is intentionally generic and lists no vendor, product, CWE, or CVSS score. Treat detections as an exposure signal rather than a discrete vulnerability. Correlate with findings on registered RPC services (NFS, statd, ypbind) which historically carry the exploitable issues that portmapper reveals.
Mitigation direction
- Restrict TCP and UDP port 111 at network and host firewalls to trusted sources.
- Disable rpcbind or portmap on hosts that do not require RPC services.
- Bind rpcbind to internal interfaces only where the service must remain.
- Follow current vendor guidance for hardening rpcbind and dependent RPC services.
- Segment NFS and other RPC dependencies onto isolated management networks.
Validation and detection
- Inventory hosts with port 111/TCP and 111/UDP listening using authenticated scans.
- Query rpcinfo from an authorized test host to confirm what RPC services are registered.
- Review firewall and cloud security group rules for any external exposure of port 111.
- Confirm rpcbind service state and startup configuration on Unix and Linux systems.
- Track findings in the vulnerability management system and close on validated remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0632 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cve.org/CVERecord?id=CVE-1999-0632CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.