===================================================================== CERT-Renater Note d'Information No. 2008/VULN513 _____________________________________________________________________ DATE : 13/11/20078 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Solaris 8, Solaris 9, Solaris 10 running Solstice X.25. ====================================================================== http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-243106-1 ______________________________________________________________________ Solution Type: Sun Alert Solution 243106 : Security Vulnerability in Solstice X.25 May Allow Denial of Service (DoS) Bug ID: 6633306 Product Solstice X.25 9.2 Date of Resolved Release: 07-Nov-2008 SA Document Body A security vulnerability in Solstice X.25 may allow a local unprivileged user with read permission for "/dev/xty" to panic a system with multiple CPUs: 1. Impact A security vulnerability in Solstice X.25 may allow a local unprivileged user with read permission for "/dev/xty" to panic a system with multiple CPUs. The ability to panic a system is a type of Denial of Service (DoS). Note: The default permissions for "/dev/xty" are "crw-rw-rw-" which allows all local users read access. 2. Contributing Factors This issue can occur in the following releases: SPARC Platform * X.25 9.2 (for Solaris 8, 9 and 10) without patch 108669-21 x86 Platform * X.25 9.2 (for Solaris 8, 9 and 10) without patch 108670-21 Note: This issue only occurs on systems with more than one CPU. To determine the number of CPUs on a system, the following command can be used: $ psrinfo 0 on-line since 09/23/2008 10:19:01 1 on-line since 09/23/2008 10:19:04 To determine if X.25 is installed and which version, run the following command: % pkginfo -l SUNWx25a | grep VERSION If the VERSION string is returned (along with the corresponding version), the system has Solstice X.25 installed. If nothing is returned, then X.25 is not installed. 3. Symptoms If the described issue occurs, the system will panic with a stack trace similar to the following: 000002a1002d0b51 qfill_syncq+0x30(30001b194a8, 300077e4980, 0, 3000718daf0, 30001b194a8, 30006f52f3c) 000002a1002d0c01 put+0x41c(30001b194a8, 780c7c08, 101, 300077e4980, 3000718 daf0, c8) 000002a1002d0cb1 putctl1+0x64(3000718daf0, 89, 43, 89, 0, 0) 000002a1002d0d61 xtclose+0x194(30007189178, 0, 10244400, 30007519400, 1047b 148, 1047b158) 000002a1002d0e11 qdetach+0x88(4400, 30000e59aa8, 2002, 30007189258, 0, 3000 7189178) 000002a1002d0ec1 strclose+0x408(30007179890, 0, 30000e59aa8, 2002, 30007179 890, 200000) 000002a1002d0f81 device_close+0x8c(30007113388, 2002, ca00000080, 30000e59a a8, 0, 0) 000002a1002d1031 spec_close+0x124(fc00, 30000e59aa8, ca00000080, 2002, 0, 0 ) 000002a1002d10e1 closef+0x58(1045d000, 30007468770, 20, 30007113388, 1, 300 07486000) 000002a1002d1191 closeandsetf+0x384(0, 0, 1b6, 0, 30006ed3530, 5) 000002a1002d1241 close+8(5, 9db30, a2a90, a2a80, 2128c, 50f34) 000002a1002d12f1 syscall_trap32+0xa8(5, 9db30, a2a90, a2a80, 2128c, 50f34) 4. Workaround To work around this issue, access to the "/dev/xty" device can be reduced using the chmod(1) command. As this reduces the usability of the device, the choice of permissions must be made depending on required device availability. 5. Resolution This issue is addressed in the following releases: SPARC Platform * X.25 9.2 (for Solaris 8, 9 and 10) with patch 108669-21 or later x86 Platform * X.25 9.2 (for Solaris 8, 9 and 10) with patch 108670-21 or later For more information on Security Sun Alerts, see Technical Instruction ID 213557. This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================