Re: Solaris Ping bug (DoS)

[alanc () GODZILLA EECS BERKELEY EDU (Alan Coopersmith)]

On Thu, 26 Jun 1997 00:08:29 -0400, Adam Caldwell <adam () ATL ENI NET> wrote:

> I briefly searched the bugtraq archives and didn't see this one, so here's a
> way to reboot a Solaris box, and is exploitable by anyone with an account on
> the system since ping is setuid root.
>
> ping -sv -i 127.0.0.1 224.0.0.1

Patches claiming to fix this were posted on ftp://sunsolve1.sun.com/pub/patches
today:
        103630-09:      SunOS 5.5.1: ip ifconfig arp udp icmp patch
        103631-09:      SunOS 5.5.1_x86: ip ifconfig arp udp icmp patch
        103169-12:      SunOS 5.5: arp,ip,udp,icmp driver and ifconfig fixes
        103170-12:      SunOS 5.5_x86: arp,ip,udp,icmp driver, ifconfig fixes

I don't see patches for earlier releases yet, but since the affected files
on those OS'es have already been put into the kernel jumbo patch, presumably
the fixes will appear in future versions of their kernel jumbo patches (which
take a lot longer to release due to the extra testing required for making such
major changes to the OS).



________________________________________________________________________
Alan Coopersmith                        alanc () godzilla EECS Berkeley EDU
Univ. of California at Berkeley         http://soar.Berkeley.EDU/~alanc/
aka:   alanc@{CSUA,OCF,CS,BMRC,ucsee.eecs,cory.eecs,server}.Berkeley.EDU