Security Vulnerabilities in Solaris Print Service May Lead to Denial of Service (DoS) or Execution of Arbitrary Code

---

Security Vulnerabilities in Solaris Print Service

1. Impact

Security vulnerabilities in the Solaris print service may allow a remote unprivileged user the ability to run arbitrary code as root or  cause  a Denial of Service (DoS) condition.

2. Contributing Factors

These issues can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 109320-20
  
• Solaris 9 without patch 113329-19
  
• Solaris 10 without patch 126672-02

x86 Platform

• Solaris 8 without patch 109321-20
  
• Solaris 9 without patch 114980-20
  
• Solaris 10 without patch 126673-02

3. Symptoms

If the issue described in BugID 6599950 occurs, users may experience a DoS condition on the Solaris print system.

There are no predictable symptoms that would indicate the described issue has been exploited to execute arbitrary code.

4. Workaround

To work around the described issues, do the following:

For Solaris 8 and Solaris 9 Systems:

Disable the BSD print protocol adaptor (in.lpd(1M)) by doing the following:

1. Edit the "/etc/inetd.conf" file and comment out the following line by adding the "#" symbol to the beginning of the line as shown:
    #printer stream tcp6 nowait root /usr/lib/print/in.lpd in.lpd

2. Tell the inetd(1M) process to reread the newly modified "/etc/inetd.conf" file by sending it a hangup signal, SIGHUP:

    # /usr/bin/pkill -HUP inetd

For Solaris 10 Systems:

Disable the main print services by executing the following commands:

    # svcadm disable svc:/application/print/rfc1179
    # svcadm disable svc:/application/print/ipp-listener
    # svcadm disable svc:/application/print/server

5. Resolution

These issues are addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 109320-20 or later
  
• Solaris 9 with patch 113329-19 or later
  
• Solaris 10 with patch 126672-02 or later
  

x86 Platform

• Solaris 8 with patch 109321-20 or later
  
• Solaris 9 with patch 114980-20 or later
  
• Solaris 10 with patch 126673-02 or later
  

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.



Modification History

27-May-2008: Updated Solaris 10 patch numbers

Attachments

This solution has no attachment