A security vulnerability in the TCP implementation of Solaris 8, 9 and 10 may allow a remote unprivileged user to cause a Solaris system which is undergoing a "TCP SYN" flood condition to be slow to accept new network connections.  Such network connections may time out without establishing a connection.  This would lead to a Denial of Service (DoS) to the network services provided by that system. In addition, a uniprocessor system may also experience overall slowdown due to high CPU usage, resulting in a Denial of Service to the system as a whole.

This issue can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 116965-33
• Solaris 9 without patch 114344-35
  
• Solaris 10 without patch 119998-01

x86 Platform

• Solaris 8 without patch 116966-32
• Solaris 9 without patch 119435-23
  
• Solaris 10 without patch 119999-01

Note:  This issue affects hosts which have a value for the ndd(1M) tunable 'tcp_conn_req_max_q0' which is considerably higher than the default value of 1024. The higher the value, the greater the impact of this issue if it is exploited on a host. While a value close to or less than 1024 does not make the system immune to a Denial of Service, it decreases the impact of a DoS on the system.

To determine the value of the 'tcp_conn_req_max_q0' tunable, the following command can be used:

    $ ndd -get /dev/tcp tcp_conn_req_max_q0
    1024

To work around the described issue, make sure the value of the ndd(1M) tunable 'tcp_conn_req_max_q0' for TCP is not much higher than the default of 1024, using commands such as the following:

    $ ndd -get /dev/tcp tcp_conn_req_max_q0 
    4000
    $ ndd -set /dev/tcp tcp_conn_req_max_q0 1024
    $ ndd -get /dev/tcp tcp_conn_req_max_q0 
    1024

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch116965-33 or later
  
• Solaris 9 with patch 114344-35 or later
  
• Solaris 10 with patch 119998-01 or later

x86 Platform

• Solaris 8 with patch 116966-32 or later
  
• Solaris 9 with patch 119435-23 or later
  
• Solaris 10 with patch 119999-01 or later