Note: This is an archival copy of Security Sun Alert 262708 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1020675.1.
Article ID : 1020675.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2010-12-05
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in the Virtual Network Terminal Server Daemon (vntsd(1M)) for Logical Domains (LDoms) May Allow Unauthorized Access to Guest Domain Console



Category
Security

Release Phase
Resolved

Bug Id
6781539

Product
Solaris 10 Operating System
OpenSolaris

Date of Resolved Release
25-Jun-2009

Security Vulnerability in the Virtual Network Terminal Server Daemon (vntsd(1M)) ... see below:

1. Impact

A security vulnerability in the Solaris Virtual Network Terminal Server
daemon (vntsd(1M)) for Logical Domains (LDoms) may allow local
unprivileged users within the control domain to gain unauthorized
access to the console of a guest domain.


2. Contributing Factors

SPARC Platform

  • Solaris 10 without patch 141778-01
  • OpenSolaris based upon builds snv_41 through snv_108

Notes: Solaris 8 and Solaris 9 are not affected as they do not support LDoms.

Solaris on the x86 Platform is not affected by this  issue as Logical Domains (LDoms)
software is supported only on the SPARC Platform.

3. Symptoms

There are no predictable symptoms to indicate that this issue has been
exploited to gain unauthorized console access to guest domains.


4. Workaround

Until the resolution patches are applied, it is possible to
workaround this issue via one of the following options:

1. Disable console access to the guest domains. This may be
done by executing the following command:

	ldmctrl:#>  svcadm disable vntsd

2. Allow console access to guest domains only from a separate sparse root zone.
This may be done by executing the following commands:

	ldmctrl:#>  svcadm disable vntsd
ldmctrl:#> svccfg -s vntsd setprop vntsd/listen_addr = <IP-address-of-sparse-root-zone>
ldmctrl:#> svcadm refresh vntsd
ldmctrl:#> svcadm enable vntsd

Firewall rules may be required to allow access only from the
sparse root zone to the ports used by the vntsd(1M) daemon.
Refer to firewall documentation for more information on configuring the tool.


5. Resolution

This issue is addressed in the following releases:

SPARC Platform

  • Solaris 10 with patch 141778-01 or later
  • OpenSolaris based upon builds snv_109 or later


For more information on Security Sun Alerts, see


References

141778-01

References

SUNPATCH:141778-01



Attachments
This solution has no attachment