A security vulnerability in the Solaris 9 in.ftpd(1M) server may allow local or remote unprivileged users to access directories outside of their home directory or to log in with their $HOME directory set to "/" (slash).

This issue is also described in CAN-2004-0148 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0148

This issue can occur in the following releases:

SPARC Platform

• Solaris 9 without patch 114564-09

x86 Platform

• Solaris 9 without patch 114565-09

Notes:

1. Solaris 8 and Solaris 10 are not affected by this issue.
2. This issue only affects systems configured as FTP servers with either the 'restricted-uid' or 'restricted-gid' clause in the ftpaccess(4) file.

To determine if the in.ftpd service is enabled on a system the following command can be used:

    $ ftp remote-host
    Connected to remote-host.domain.com.
    220 remote-host FTP server ready.
    Name (remote-host:username):

There are no predictable symptoms that would indicate the described issue has been exploited.

To work around the described issue until patches can be applied, disable the in.ftpd(1M) daemon with the following steps:

1. Edit the "/etc/inetd.conf" file and comment out the following line by prepending the "#" symbol, as in the following example:

    #ftp stream tcp6 nowait root /usr/sbin/in.ftpd in.ftpd

2. Send the inetd(1M) process a hangup signal (SIGHUP) to that inetd will reread the inetd.conf configuration file:

    # pkill -HUP inetd

This will disable in.ftpd(1M).

This issue is addressed in the following releases:

SPARC Platform

• Solaris 9 with patch 114564-09 or later

x86 Platform

• Solaris 9 with patch 114565-09 or later

23-May-2006:

• Updated Contributing Factors and Resolution sections

This solution has no attachment