Solaris DMI Denial of Service Vulnerabilities
BID:878
Info
Solaris DMI Denial of Service Vulnerabilities
| Bugtraq ID: | 878 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 22 1999 12:00AM |
| Updated: | Dec 22 1999 12:00AM |
| Credit: | First posted to Bugtraq by Brock Tellier <[email protected]> on December 22, 1999. |
| Vulnerable: |
Sun Solaris 7.0_x86 Sun Solaris 7.0 |
| Not Vulnerable: | |
Discussion
Solaris DMI Denial of Service Vulnerabilities
DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely).
DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely).
Exploit / POC
Solaris DMI Denial of Service Vulnerabilities
This was taken from Brock Tellier's <[email protected]> Bugtraq post:
Buffer Overflow Crash:
echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif
dmi_cmd -CI ../../../usr/home/btellier/my.mif
(dmispd segfaults)
This was taken from Brock Tellier's <[email protected]> Bugtraq post:
Buffer Overflow Crash:
echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif
dmi_cmd -CI ../../../usr/home/btellier/my.mif
(dmispd segfaults)
Solution / Fix
Solaris DMI Denial of Service Vulnerabilities
Solution:
Patches are available to all sun customers at http://sunsolve.sun.com
It is believed patch 107709-04 for sparc, and 107710-04 for x86, will remedy these problems.
Sun Solaris 7.0_x86
Sun Solaris 7.0
Solution:
Patches are available to all sun customers at http://sunsolve.sun.com
It is believed patch 107709-04 for sparc, and 107710-04 for x86, will remedy these problems.
Sun Solaris 7.0_x86
Sun Solaris 7.0
References
Solaris DMI Denial of Service Vulnerabilities
References:
References: