Note: This is an archival copy of Security Sun Alert 201136 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000855.1.
Solaris 9 Operating System
Date of Workaround Release
Date of Resolved Release
A security vulnerability in the Solaris 9 in.ftpd(1M) server may allow local or remote unprivileged users to access directories outside of their home directory or to log in with their $HOME directory set to "/" (slash).
This issue is also described in CAN-2004-0148 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0148
This issue can occur in the following releases:
To determine if the in.ftpd service is enabled on a system the following command can be used:
$ ftp remote-host Connected to remote-host.domain.com. 220 remote-host FTP server ready. Name (remote-host:username):
There are no predictable symptoms that would indicate the described issue has been exploited.
To work around the described issue until patches can be applied, disable the in.ftpd(1M) daemon with the following steps:
1. Edit the "/etc/inetd.conf" file and comment out the following line by prepending the "#" symbol, as in the following example:
#ftp stream tcp6 nowait root /usr/sbin/in.ftpd in.ftpd
2. Send the inetd(1M) process a hangup signal (SIGHUP) to that inetd will reread the inetd.conf configuration file:
# pkill -HUP inetd
This will disable in.ftpd(1M).
This issue is addressed in the following releases:
This solution has no attachment