Category
Security
Release Phase
Resolved
Bug Id
6781539
ProductSolaris 10 Operating System
OpenSolaris
Date of Resolved Release25-Jun-2009
Security Vulnerability in the Virtual Network Terminal Server Daemon (vntsd(1M)) ... see below:
1. Impact
A security vulnerability in the Solaris Virtual Network Terminal Server
daemon (vntsd(1M)) for Logical Domains (LDoms) may allow local
unprivileged users within the control domain to gain unauthorized
access to the console of a guest domain.
2. Contributing Factors
SPARC Platform
- Solaris 10 without patch 141778-01
- OpenSolaris based upon builds snv_41 through snv_108
Notes: Solaris 8 and Solaris 9 are not affected as they do
not support LDoms.
Solaris on the x86 Platform is not affected by this
issue as Logical Domains (LDoms)
software is supported only on
the SPARC Platform.
3. Symptoms
There are no predictable symptoms to indicate that this issue has
been
exploited to gain unauthorized console access to guest domains.
4. Workaround
Until the resolution patches are applied, it is possible to
workaround this issue via one of the following options:
1. Disable console access to the guest domains. This may be
done by executing the following command:
ldmctrl:#> svcadm disable vntsd
2. Allow console access to guest domains only from a separate sparse root zone.
This may be done by executing the following commands:
ldmctrl:#> svcadm disable vntsd
ldmctrl:#> svccfg -s vntsd setprop vntsd/listen_addr = <IP-address-of-sparse-root-zone>
ldmctrl:#> svcadm refresh vntsd
ldmctrl:#> svcadm enable vntsd
Firewall rules may be required to allow access only from the
sparse root zone to the ports used by the vntsd(1M) daemon.
Refer to firewall documentation for more information on configuring the tool.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
- Solaris 10 with patch 141778-01 or later
- OpenSolaris based upon builds snv_109 or later
For more information on Security Sun Alerts, see
References
141778-01
References
SUNPATCH:141778-01
AttachmentsThis solution has no attachment