The Solaris 9 and Solaris 10 FTP Server, in.ftpd(1M), is based on WU-FTPD (Washington University ftpd) and are affected by a security vulnerability in the "wu_fnmatch" function which may allow a local or remote unprivileged user the ability to cause a Denial of Service (DoS) by consuming a large amount of CPU resources.

Additional information on this issue can be found in the following documents:

• CAN-2005-0256 (see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0256)
• iDEFENSE Security Advisory 02.25.05 (see: http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities)

This issue can occur in the following releases:

SPARC Platform

• Solaris 9 without patch 114564-05
• Solaris 10 without patch 120085-01

x86 Platform

• Solaris 9 without patch 114565-05
• Solaris 10 without patch 120086-01

Notes:

1. Solaris 7 and Solaris 8 are not affected by this issue.
2. This issue only impacts the "WU-FTPD" version of in.ftpd(1M).
3. This issue only affects systems which are enabled as in.ftpd(1M) servers.

If the described issue occurs, the CPU utilization will go up to 100% and the prstat(1M) command will show that the "in.ftpd" process is consuming a lot of CPU time.

Symptoms similar to the following may be seen:

• Slow running applications
• Delayed response from the terminals
• Slow response over the network

To work around the described issue, disable ftp(1) service by doing the following:

On Solaris 9

1. Login as root.

2. Edit the "/etc/inetd.conf" file and comment out the line starting with "ftp".

3. Tell the inetd(1M) process to reread the newly modified "/etc/inetd.conf" file by sending it a hangup signal, SIGHUP:

    # pkill -HUP inetd

On Solaris 10

1. Login as root.

2. Disable the in.ftpd(1M) server using the following command:

    # svcadm disable ftp

This issue is addressed in the following releases:

SPARC Platform

• Solaris 9 with patch 114564-05 or later
• Solaris 10 with patch 120085-01 or later

x86 Platform

• Solaris 9 with patch 114565-05 or later
• Solaris 10 with patch 120086-01 or later

Change History

23-May-2005:

• Updated Relief/Workaround section

• Updated Contributing Factors and Relief/Workaround sections

• State: Resolved
• Updated Contributing Factors and Resolution Sections

This solution has no attachment