Sun Solaris and OpenSolaris Local IP Multicast Filter Integer Overflow Vulnerability

Bugtraq ID:	29699
Class:	Boundary Condition Error
CVE:	CVE-2008-2710
Remote:	No
Local:	Yes
Published:	Jun 12 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Tobias Klein
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10_sparc Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_13 Sun OpenSolaris 0 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0
Not Vulnerable:

Sun Solaris and OpenSolaris Local IP Multicast Filter Integer Overflow Vulnerability

Sun Solaris and OpenSolaris are prone to a vulnerability in the IP Multicast Filter processing of sockets because the software fails to adequately bounds-check user-supplied data.

An attacker can exploit this vulnerability to execute arbitrary code with superuser privileges. Failed exploit attempts will likely cause denial-of-service conditions.

This issue affects Solaris 10 and OpenSolaris builds snv_13 through snv_91 for SPARC and x86 platforms.

Sun Solaris and OpenSolaris Local IP Multicast Filter Integer Overflow Vulnerability

The following proof-of-concept exploit is available to members of the Immunity Partner's Program:

https://www.immunityinc.com/downloads/immpartners/ipmfs.c

Sun Solaris and OpenSolaris Local IP Multicast Filter Integer Overflow Vulnerability

Solution:
The vendor has released a fix. Please see the references for more information.

Sun Solaris and OpenSolaris Local IP Multicast Filter Integer Overflow Vulnerability

References:

• Sun Solaris SIOCSIPMSFILTER Kernel Integer Overflow (Tobias Klein)
  
• ASA-2008-262 A Security Vulnerability in IP Multicast Filter processing of Socke (Avaya)
  
• Sun Alert 6597712: Integer Overflow in IP Multicast Filter processing (Sun Microsystems)