Note: This is an archival copy of Security Sun Alert 200687 as previously published on http://sunsolve.sun.com. Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000542.1. |
Category Security Release Phase Resolved Solaris 9 Operating System Solaris 10 Operating System Bug Id 6239487 Date of Workaround Release 20-MAY-2005 Date of Resolved Release 06-JUL-2005 Impact The Solaris 9 and Solaris 10 FTP Server, in.ftpd(1M), is based on WU-FTPD (Washington University ftpd) and are affected by a security vulnerability in the "wu_fnmatch" function which may allow a local or remote unprivileged user the ability to cause a Denial of Service (DoS) by consuming a large amount of CPU resources. Additional information on this issue can be found in the following documents:
Contributing Factors This issue can occur in the following releases: SPARC Platform
x86 Platform
Notes:
Symptoms If the described issue occurs, the CPU utilization will go up to 100% and the prstat(1M) command will show that the "in.ftpd" process is consuming a lot of CPU time. Symptoms similar to the following may be seen:
Workaround To work around the described issue, disable ftp(1) service by doing the following: On Solaris 9 1. Login as root. 2. Edit the "/etc/inetd.conf" file and comment out the line starting with "ftp". 3. Tell the inetd(1M) process to reread the newly modified "/etc/inetd.conf" file by sending it a hangup signal, SIGHUP: # pkill -HUP inetd On Solaris 10 1. Login as root. 2. Disable the in.ftpd(1M) server using the following command: # svcadm disable ftp Resolution This issue is addressed in the following releases: SPARC Platform
x86 Platform
Modification History Date: 23-MAY-2005 Change History23-May-2005:
Date: 08-JUN-2005
Date: 06-JUL-2005
References114565-05114564-05 120086-01 120085-01 Attachments This solution has no attachment |
|