Multiple Vulnerabilities in the Solaris 8 and 9 sadmind(1M) Daemon May Lead to Arbitrary Code Execution |
|
| Category : | Security |
| Release Phase : | Resolved |
| Bug Id : | 6765885, 6766465
|
| Product : | Solaris 8 Operating System
Solaris 9 Operating System
|
| Date of Resolved Release : | 22-May-2009
|
Multiple Vulnerabilities in the Solaris 8 and 9 sadmind(1M) Daemon May Lead to Arbitrary Code Execution
1. Impact
On Solaris 8 and 9 heap and integer overflow vulnerabilities in the Solaris sadmind(1M) daemon
may allow a local or remote unprivileged user to execute arbitrary code with root privileges.
Sun acknowledges with thanks Secunia Research for bringing these issues to our attention.
These issues are also described in the following documents:
CVE-2008-3869 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3869
CVE-2008-3870 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3870
2. Contributing Factors
These issues can occur in the following releases:
SPARC Platform
x86 Platform
Note: Solaris 10 and OpenSolaris do not ship with sadmind(1M) and therefore are not affected by these issues.
To determine if sadmind(1M) is enabled on the system, the following command can be run:
$ grep sadmind /etc/inet/inetd.conf
100232/10 tli rpc/udp wait root /usr/sbin/sadmind sadmind
3. Symptoms
There are no predictable symptoms that would indicate these issues have been exploited to execute arbitrary code.
4. Workaround
To work around these issues, sadmind(1M) can be disabled by doing the following:
1. Edit the '/etc/inetd.conf' file as the root user to comment out the entry for sadmind(1M).
This entry will then read as:
#100232/10 tli rpc/udp wait root /usr/sbin/sadmind sadmind
2. Restart the inetd(1M) process to reread the newly modified '/etc/inetd.conf' file.
This may be done using the following command:
# /usr/bin/pkill -HUP inetd
5. Resolution
These issues are addressed in the following releases:
SPARC Platform
x86 Platform
For more information on Security Sun Alerts, see Technical Instruction ID 213557
http://sunsolve.sun.com/search/document.do?assetkey=1-61-213557-1
This Sun Alert notification is being provided to you on an "AS IS"
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
AttachmentsThis solution has no attachment
|
Subscribe |
Careers |
Contact Us |
Site Maps |
Legal Notices |
Terms of Use |
Your Privacy Rights |
Sun Contracted Content
Sun Contracted Feature
