Bug Id
6633306

Product
Solstice X.25 9.2

Date of Resolved Release
07-Nov-2008

A security vulnerability in Solstice X.25 may allow a local unprivileged user with read permission for "/dev/xty" to panic a system with multiple CPUs:

1. Impact

A security vulnerability in Solstice X.25 may allow a local unprivileged user with read permission for "/dev/xty" to panic a system with multiple CPUs. The ability to panic a system is a type of Denial of Service (DoS).

Note: The default permissions for "/dev/xty" are "crw-rw-rw-" which allows all local users read access.

2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• X.25 9.2 (for Solaris 8, 9 and 10) without patch 108669-21

x86 Platform

• X.25 9.2 (for Solaris 8, 9 and 10) without patch 108670-21

Note: This issue only occurs on systems with more than one CPU. To determine the number of  CPUs on a system, the following command can be used:

    $ psrinfo
    0   on-line   since 09/23/2008 10:19:01
    1   on-line   since 09/23/2008 10:19:04

To determine if X.25 is installed and which version, run the following command:

    % pkginfo -l SUNWx25a | grep VERSION

If the VERSION string is returned (along with the corresponding version), the system has Solstice X.25 installed. If nothing is returned, then X.25 is not installed.

3. Symptoms

If the described issue occurs, the system will panic with a stack trace  similar to the following:

    000002a1002d0b51 qfill_syncq+0x30(30001b194a8, 300077e4980, 0, 3000718daf0, 30001b194a8, 30006f52f3c)
    000002a1002d0c01 put+0x41c(30001b194a8, 780c7c08, 101, 300077e4980, 3000718daf0, c8)
    000002a1002d0cb1 putctl1+0x64(3000718daf0, 89, 43, 89, 0, 0)
    000002a1002d0d61 xtclose+0x194(30007189178, 0, 10244400, 30007519400, 1047b148, 1047b158)
    000002a1002d0e11 qdetach+0x88(4400, 30000e59aa8, 2002, 30007189258, 0, 30007189178)
    000002a1002d0ec1 strclose+0x408(30007179890, 0, 30000e59aa8, 2002, 30007179890, 200000)
    000002a1002d0f81 device_close+0x8c(30007113388, 2002, ca00000080, 30000e59aa8, 0, 0)
    000002a1002d1031 spec_close+0x124(fc00, 30000e59aa8, ca00000080, 2002, 0, 0)
    000002a1002d10e1 closef+0x58(1045d000, 30007468770, 20, 30007113388, 1, 30007486000)
    000002a1002d1191 closeandsetf+0x384(0, 0, 1b6, 0, 30006ed3530, 5)
    000002a1002d1241 close+8(5, 9db30, a2a90, a2a80, 2128c, 50f34)
    000002a1002d12f1 syscall_trap32+0xa8(5, 9db30, a2a90, a2a80, 2128c, 50f34)

4. Workaround

To work around this issue, access to the "/dev/xty" device can be reduced using the chmod(1) command. As this reduces the usability of the device, the choice of permissions must be made depending on required device availability.

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

• X.25 9.2 (for Solaris 8, 9 and 10) with patch 108669-21 or later

x86 Platform

• X.25 9.2 (for Solaris 8, 9 and 10) with patch 108670-21 or later
  

For more information on Security Sun Alerts, see 1009886.1.


This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.

References

108669-21
108670-21





Attachments

This solution has no attachment