===================================================================== CERT-Renater Note d'Information No. 2005/VULN303 _____________________________________________________________________ DATE : 17/05/2005 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Solaris 7, Solaris 8, Solaris 9. ====================================================================== Sun(sm) Alert Notification * Sun Alert ID: 57786 * Synopsis: automountd(1M) May Stop When Accessing "/xfn/_x500" * Category: Security * Product: Solaris * BugIDs: 4807798 * Avoidance: Workaround, Patch * State: Resolved * Date Released: 10-May-2005 * Date Closed: 10-May-2005 * Date Modified: 1. Impact A local unprivileged user may be able to create a denial of service by killing the automountd(1M) daemon. This would affect all applications that utilize autofs(4) file systems which are automatically mounted by the automountd(1M) daemon. 2. Contributing Factors This issue can occur in the following releases: SPARC Platform * Solaris 7 without patch 119423-01 * Solaris 8 without patch 116997-01 * Solaris 9 without patch 117485-01 x86 Platform * Solaris 7 without patch 119424-01 * Solaris 8 without patch 116998-01 * Solaris 9 without patch 117486-01 Note: Solaris 10 does not have Federated Naming Services (FNS) and is not impacted by this issue. The described issue only occurs if all of the following conditions are true: 1. Federated Naming Services (FNS) support for X.500 directory context is installed 2. Federated Naming Services (FNS) is enabled in "/etc/auto_master" (This is the default) 3. autofs(4) is installed and started at boot (This is the default) 4. FNS X.500 configuration (/etc/fn/x500.conf) references a valid LDAP server. By default the configuration includes a server named "ldap" To determine if FNS support for X.500 directory context is installed, the following command can be run: $ pkginfo SUNWfnsx5 system SUNWfnsx5 FNS Support For X.500 Directory Context To determine if FNS is enabled in "/etc/auto_master", the following command can be run: $ grep /xfn /etc/auto_master /xfn -xfn To determine if autofs(4) is installed and started at boot, the following command can be run: $ pkginfo SUNWatfsu system SUNWatfsu AutoFS, (Usr) $ ls /etc/rc2.d/S74autofs /etc/rc2.d/S74autofs To determine if FNS X.500 configuration references a valid LDAP server, the following command can be run: $ grep ldap /etc/fn/x500.conf # x500-access: # ldap-servers: x500-access: xds ldap ldap-servers: localhost ldap $ getent hosts ldap 64.124.140.199 ldap.sun.com Note: This issue is very rarely encountered even on systems that meet all of the conditions listed above. 3. Symptoms If the described issue occurs, the automountd(1M) process is absent. This can be seen by using the pgrep(1m) command: $ pgrep automountd || echo "automountd process NOT found!" In general, processes or applications attempting to access files or directories that rely on autofs(4) may fail with error messages such as "no such file or directory" or "does not exist". As an example, the Bourne shell (/usr/bin/sh) attempting to change directory to a known autofs(4) path would result in the following: $ cd /share/local /share/local: does not exist Solution Summary 4. Relief/Workaround To work around the described issue, one of the following options can be applied: Option 1 Restart automountd(1M) using the following command as root: # pgrep automountd || /etc/init.d/autofs start The following simple Bourne script will check and restart automountd(1M) as necessary: # while pgrep automountd || /etc/init.d/autofs start; do sleep 10; done Option 2 If FNS X.500 is not intended to be used with LDAP, remove the server name "ldap" from the "/etc/fn/x500.conf" file. Option 3 Remove the "/xfn" entry from the "auto_master" mapfile (either in files or NIS, NIS+, or LDAP). Option 4 If FNS is not being used, remove the FNS packages: SUNWfns Federated Naming System SUNWfnsx Federated Naming System (64-bit) SUNWfnsx5 FNS Support For X.500 Directory Context Refer to the pkgrm(1M) command for additional information on removing packages. 5. Resolution This issue is addressed in the following releases: SPARC Platform * Solaris 7 with patch 119423-01 or later * Solaris 8 with patch 116997-01 or later * Solaris 9 with patch 117485-01 or later x86 Platform * Solaris 7 with patch 119424-01 or later * Solaris 8 with patch 116998-01 or later * Solaris 9 with patch 117486-01 or later This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================