Product
Solaris 9 Operating System

Bug Id
5012436

Date of Workaround Release
18-MAY-2006

Date of Resolved Release
23-MAY-2006

Impact

A security vulnerability in the Solaris 9 in.ftpd(1M) server may allow local or remote unprivileged users to access directories outside of their home directory or to log in with their $HOME directory set to "/" (slash).

This issue is also described in CAN-2004-0148 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0148

Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• Solaris 9 without patch 114564-09

x86 Platform

• Solaris 9 without patch 114565-09

Notes:

1. Solaris 8 and Solaris 10 are not affected by this issue.
2. This issue only affects systems configured as FTP servers with either the 'restricted-uid' or 'restricted-gid' clause in the ftpaccess(4) file.

To determine if the in.ftpd service is enabled on a system the following command can be used:

    $ ftp remote-host
    Connected to remote-host.domain.com.
    220 remote-host FTP server ready.
    Name (remote-host:username):

Symptoms

There are no predictable symptoms that would indicate the described issue has been exploited.

Workaround

To work around the described issue until patches can be applied, disable the in.ftpd(1M) daemon with the following steps:

1. Edit the "/etc/inetd.conf" file and comment out the following line by prepending the "#" symbol, as in the following example:

    #ftp stream tcp6 nowait root /usr/sbin/in.ftpd in.ftpd

2. Send the inetd(1M) process a hangup signal (SIGHUP) to that inetd will reread the inetd.conf configuration file:

    # pkill -HUP inetd

This will disable in.ftpd(1M).

Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 9 with patch 114564-09 or later

x86 Platform

• Solaris 9 with patch 114565-09 or later

Modification History
Date: 23-MAY-2006

23-May-2006:

• Updated Contributing Factors and Resolution sections

References

114564-09
114565-09




Attachments

This solution has no attachment