Note: This is an archival copy of Security Sun Alert 262708 as previously published on
Latest version of this security advisory is available from as Sun Alert 1020675.1.
Article ID : 1020675.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2010-12-05
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in the Virtual Network Terminal Server Daemon (vntsd(1M)) for Logical Domains (LDoms) May Allow Unauthorized Access to Guest Domain Console


Release Phase

Bug Id

Solaris 10 Operating System

Date of Resolved Release

Security Vulnerability in the Virtual Network Terminal Server Daemon (vntsd(1M)) ... see below:

1. Impact

A security vulnerability in the Solaris Virtual Network Terminal Server
daemon (vntsd(1M)) for Logical Domains (LDoms) may allow local
unprivileged users within the control domain to gain unauthorized
access to the console of a guest domain.

2. Contributing Factors

SPARC Platform

  • Solaris 10 without patch 141778-01
  • OpenSolaris based upon builds snv_41 through snv_108

Notes: Solaris 8 and Solaris 9 are not affected as they do not support LDoms.

Solaris on the x86 Platform is not affected by this  issue as Logical Domains (LDoms)
software is supported only on the SPARC Platform.

3. Symptoms

There are no predictable symptoms to indicate that this issue has been
exploited to gain unauthorized console access to guest domains.

4. Workaround

Until the resolution patches are applied, it is possible to
workaround this issue via one of the following options:

1. Disable console access to the guest domains. This may be
done by executing the following command:

	ldmctrl:#>  svcadm disable vntsd

2. Allow console access to guest domains only from a separate sparse root zone.
This may be done by executing the following commands:

	ldmctrl:#>  svcadm disable vntsd
ldmctrl:#> svccfg -s vntsd setprop vntsd/listen_addr = <IP-address-of-sparse-root-zone>
ldmctrl:#> svcadm refresh vntsd
ldmctrl:#> svcadm enable vntsd

Firewall rules may be required to allow access only from the
sparse root zone to the ports used by the vntsd(1M) daemon.
Refer to firewall documentation for more information on configuring the tool.

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

  • Solaris 10 with patch 141778-01 or later
  • OpenSolaris based upon builds snv_109 or later

For more information on Security Sun Alerts, see





This solution has no attachment