Re: Possible DoS against inetd in Solaris

["Larry W. Cashdollar" <lwc () VAPID DHS ORG>]

   It could be the recursive mutex bug in solaris, are these sun boxes up
to date on their patch clusters?  I was able to crash a poorly patched
Solaris 2.6 system with just a plain nmap scan. and then sending a HUP
signal to inetd killed the server.   After I applied the new patch cluster
it was no longer a problem.


On Wed, 15 Nov 2000, Alla Bezroutchko wrote:

> Hi,
>
> I stumbled upon something that looks like a bug in inetd on Solaris. If
> a Solaris box is portscaned by nmap with -T Insane option (very quick
> scan) daemons that are started by inetd stop responding. That is you
> can connect to them, connection get accepted, by they don't display any
> banner or answer in any way. It stays that way until inetd is
> restarted. Other daemons (not started by inetd) seem to be unaffected
> by this.
>
> The effect depends on number of daemons enabled in inetd configuration.
> If only one daemon (ftp in my case) is enabled, nothing happens at all.
> Inetd with two daemons does hang but not always. Five daemons enabled
> make it hang every time.
>
> I tested this over a 10Mbps LAN against Solaris 7 and 8 on Sparc and
> Solaris 7 on Intel.  All three are affected.
>
> Don't know if it works over slower connections. It is also interesting
> if it only affects inetd, or any daemon that listens on multiple
> ports. Could someone test this?
>
> --
> Alla Bezroutchko
> Scanit Team
> http://www.scanit.be/