Solaris Recursive mutex_enter Panic Vulnerability

Bugtraq ID:	655
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 23 1999 12:00AM
Updated:	Sep 23 1999 12:00AM
Credit:	This vulnerability was found by David Brumley <[email protected]>.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

Solaris Recursive mutex_enter Panic Vulnerability

A vulnerability in Solaris TCP/IP stack may allow remote users to panic the system.

If the nmap network mapping utility is used with the OS fingerprinting option ('-O') against an active listening port and the server listening on that port is then killed the system will panic because of recursive calls to mutex_enter within the TCP streams driver.


This is Sun BugID 4178455.

Solaris Recursive mutex_enter Panic Vulnerability

$nmap -O -p 80 targethost.com

Solaris Recursive mutex_enter Panic Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 7.0_x86

• Sun 106542-05
  

Sun Solaris 2.6

• Sun 105529-07
  sparc
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-105529-07-1

Sun Solaris 7.0

• Sun 106541-05
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-106541-05-1

Sun Solaris 2.6_x86

• Sun 105530-01
  x86
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-105530-01-1

Sun Solaris 2.5.1 _x86

• Sun 103582-20
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-103582-20-1

Sun Solaris 2.5.1

• Sun 103581-20
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-103581-20-1

Solaris Recursive mutex_enter Panic Vulnerability

References:

• Nmap Home Page (Fyodor)
  
• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)