Sun Solaris 'CODE_GET_VERSION IOCTL' Local Denial Of Service Vulnerability

Bugtraq ID:	38016
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 31 2010 12:00AM
Updated:	Apr 13 2010 10:44PM
Credit:	Tobias Klein
Vulnerable:	Sun Solaris 10_x86 Sun OpenSolaris build snv_99 Sun OpenSolaris build snv_98 Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_94 Sun OpenSolaris build snv_93 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_86 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_84 Sun OpenSolaris build snv_83 Sun OpenSolaris build snv_82 Sun OpenSolaris build snv_81 Sun OpenSolaris build snv_80 Sun OpenSolaris build snv_78 Sun OpenSolaris build snv_77 Sun OpenSolaris build snv_76 Sun OpenSolaris build snv_71 Sun OpenSolaris build snv_133 Sun OpenSolaris build snv_132 Sun OpenSolaris build snv_131 Sun OpenSolaris build snv_130 Sun OpenSolaris build snv_129 Sun OpenSolaris build snv_128 Sun OpenSolaris build snv_127 Sun OpenSolaris build snv_126 Sun OpenSolaris build snv_125 Sun OpenSolaris build snv_124 Sun OpenSolaris build snv_123 Sun OpenSolaris build snv_122 Sun OpenSolaris build snv_121 Sun OpenSolaris build snv_120 Sun OpenSolaris build snv_119 Sun OpenSolaris build snv_118 Sun OpenSolaris build snv_117 Sun OpenSolaris build snv_116 Sun OpenSolaris build snv_115 Sun OpenSolaris build snv_114 Sun OpenSolaris build snv_113 Sun OpenSolaris build snv_112 Sun OpenSolaris build snv_111a Sun OpenSolaris build snv_111 Sun OpenSolaris build snv_110 Sun OpenSolaris build snv_109 Sun OpenSolaris build snv_108 Sun OpenSolaris build snv_107 Sun OpenSolaris build snv_106 Sun OpenSolaris build snv_105 Sun OpenSolaris build snv_104 Sun OpenSolaris build snv_103 Sun OpenSolaris build snv_102 Sun OpenSolaris build snv_101a Sun OpenSolaris build snv_101 Sun OpenSolaris build snv_100 Sun OpenSolaris 0
Not Vulnerable:	Sun OpenSolaris build snv_134

Sun Solaris 'CODE_GET_VERSION IOCTL' Local Denial Of Service Vulnerability

Sun Solaris is prone to a local denial-of-service vulnerability.

Local attackers can exploit the issue to cause a denial-of-service condition.

The issue affects Solaris 10 and OpenSolaris for x86 platforms.

Sun Solaris 'CODE_GET_VERSION IOCTL' Local Denial Of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/38016.c

Sun Solaris 'CODE_GET_VERSION IOCTL' Local Denial Of Service Vulnerability

Solution:
Patches are available. Please see the references for details.


Sun Solaris 10_x86

• Sun 127128-11
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -127128-11-1


• Sun 143913-01
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -143913-01-1

Sun Solaris 'CODE_GET_VERSION IOCTL' Local Denial Of Service Vulnerability

References:

• Kernel NULL Pointer Dereference in (Open)Solaris (Tobias Klein)
  
• OpenSolaris Homepage (Oracle)
  
• Oracle Solaris UCODE_GET_VERSION IOCTL Kernel NULL Pointer Dereference (Tobias Klein)
  
• Solaris Homepage (Sun Microsystems)
  
• SunOS 5.10_x86: ucode driver patch (Sun)
  
• Oracle Critical Patch Update April 2010 (Oracle)
  
• This Alert Covers CVE-2010-0453 for the /dev/ucode Component of the Solaris and (Sun)