Note: This is an archival copy of Security Sun Alert 249966 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019967.1.
Solaris 8 Operating System
Solaris 9 Operating System
Solaris 10 Operating System
Date of Resolved Release
A security vulnerability in the Solaris "autofs" kernel module may allow a local unprivileged user to cause "autofs" mounts to break:
A security vulnerability in the Solaris "autofs" kernel module may allow a local unprivileged user to cause "autofs" mounts to break, which is a type of Denial of Service (DoS). In rare occurrences, this may allow an unprivileged user to execute code as a root user.
2. Contributing Factors
This issue can occur in the following releases:
To determine if "autofs" is enabled on Solaris 10 and OpenSolaris systems, use the following command and verify that the "enabled" state is "true":
$ svcs -l autofsTo determine if "autofs" is enabled on Solaris 8 and Solaris 9 systems, use the following command and verify that the automountd(1M) process is running:
$ ps -ef | grep autofs
Note 2: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. To determine the base build of OpenSolaris, the following command can be used:
$ uname -v3. Symptoms
If the described issue occurs an "autofs" mount can fail. There are no predictable symptoms that would indicate that the issue has been exploited to execute arbitrary commands.
To work around the described issue, disable the use of "autofs":
To disable "autofs" on Solaris 10 and OpenSolaris systems, run the following command:
# svcadm disable autofsTo re-enable "autofs" on Solaris 10 and OpenSolaris systems, run the following command:
# svcadm enable autofsTo disable "autofs" on Solaris 8 and Solaris 9 systems, run the following commands:
# /etc/init.d/autofs stop
To re-enable "autofs" on Solaris 8 and Solaris 9 systems, run the following commands:
# /etc/init.d/autofs start5. Resolution
This issue is addressed in the following releases:
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
02-Feb-2009: Updated the Workaround section.
This solution has no attachment