=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2007/VULN340
_____________________________________________________________________

DATE                      : 03/08/2007

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Solaris 10 running DTrace D Programs.

======================================================================

    Sun(sm) Alert Notification
      * Sun Alert ID: 103021
      * Synopsis: Solaris 10 Systems May Panic or Hang When Running
        Certain DTrace D Programs
      * Category: Security
      * Product: Solaris 10 Operating System
      * BugIDs: 6479756
      * Avoidance: Patch, Workaround
      * State: Resolved
      * Date Released: 30-Jul-2007
      * Date Closed: 30-Jul-2007
      * Date Modified:

1. Impact

    A security vulnerability in the DTrace (see dtrace(1M)) dynamic
    tracing framework may allow a local user who has privileges to run
    certain DTrace programs to cause the system to panic or become
    unresponsive. This is a type of Denial of Service (DoS). The minimum
    privilege required is the PRIV_DTRACE_USER privilege (see
    privileges(5)).

2. Contributing Factors

    This issue can occur in the following releases:

    SPARC platform
      * Solaris 10 without patch 125100-10

    x86 Platform
      * Solaris 10 without patch 125101-10

    Note: This issue does not affect Solaris 8 or Solaris 9.

3. Symptoms

    If this issue is encountered on a SPARC system, especially those based
    on the UltraSPARC T1 processor, the system will typically panic with
    an error message of "send mondo timeout".

    It is unlikely for this issue to occur on x86 based systems but if it
    does occur the system will appear to be either hung or extremely slow.

4. Relief/Workaround

    If users have been granted any of the DTrace privileges then those
    privileges can be removed until the patches have been applied. The
    additional privileges may have been configured via policy.conf(4) or
    user_attr(4). If the privileges have been configured directly in the
    local "/etc/user_attr" file, then they can be removed using the
    usermod(1M) utility as shown:
     # usermod -K limitpriv=all,!dtrace_user,!dtrace_proc,!dtrace_kernel user

    Note: Privileges may also be assigned via an execution profile (see
    exec_attr(4)) or even to running processes using ppriv(1).

5. Resolution

    This issue is addressed in the following releases:

    SPARC platform
      * Solaris 10 with patch 125100-10 or later

    x86 platform
      * Solaris 10 with patch 125101-10 or later

    This Sun Alert notification is being provided to you on an "AS IS"
    basis. This Sun Alert notification may contain information provided by
    third parties. The issues described in this Sun Alert notification may
    or may not impact your system(s). Sun makes no representations,
    warranties, or guarantees as to the information contained herein. ANY
    AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
    WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
    NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
    YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
    INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
    OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
    This Sun Alert notification contains Sun proprietary and confidential
    information. It is being provided to you pursuant to the provisions of
    your agreement to purchase services from Sun, or, if you do not have
    such an agreement, the Sun.com Terms of Use. This Sun Alert
    notification may only be used for the purposes contemplated by these
    agreements.

    Copyright 2000-2006 Sun Microsystems, Inc., 4150 Network Circle, Santa
    Clara, CA 95054 U.S.A. All rights reserved.

======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================