Note: This is an archival copy of Security Sun Alert 245806 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019777.1.
Solaris 8 Operating System
Solaris 9 Operating System
Date of Workaround Release
Date of Resolved Release
A Buffer Overflow Security Vulnerability in the Solaris sadmind(1M) Daemon May Lead to Execution of Arbitrary Code
A buffer overflow security vulnerability in the Solaris sadmind(1M) daemon may allow a local or remote unprivileged user to execute arbitrary code with root privileges.
Sun acknowledges with thanks, Adriano Lima of RISE security for bringing this issue to our attention.
This issue is described in the following documents:
RISE-2008001 at http://risesecurity.org/advisories/RISE-2008001.txt
CVE-2008-4556 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4556
2. Contributing Factors
This issue can occur in the following releases:
1. Solaris 8 entered EOSL Phase 2 on 1 April 2009. Entitlement to patches developed on or after 1 April 2009 requires the purchase of the Solaris 8 Vintage Patch Service. See note in section 5 for more details.
2. Solaris 10 and OpenSolaris do not ship with sadmind(1M) and therefore are not affected by this issue.
To determine if sadmind(1M) is enabled on the system, the following command can be run:
$ grep sadmind /etc/inet/inetd.conf
There are no predictable symptoms that would indicate this issue has been exploited to execute arbitrary code.
To work around this issue, sadmind(1M) can be disabled by doing the following:
1. Edit the '/etc/inetd.conf' file as the root user to comment out the entry for sadmind(1M). This entry will then read as:
#100232/10 tli rpc/udp wait root /usr/sbin/sadmind sadmind2. Restart the inetd(1M) process to reread the newly modified '/etc/inetd.conf' file. This may be done using the following command:
# /usr/bin/pkill -HUP inetd5. Resolution
This issue is addressed in the following releases:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
09-Jan-2009: Updated Workaround section for IDRs
22-May-2009: Updated Contributing Factors and Resolution sections, Resolved
This solution has no attachment