SUMMARY: Security: /usr/bin/ping can cause machine to reboot.

From: Ross Golder (rossg@cpd.co.uk)
Date: Mon Jul 07 1997 - 09:11:57 CDT


> In a recent message, Ross Golder said:
> >
> > On friday evening, I tried to issue a ping command, as described on
> the
> > comp.unix.solaris newsgroup, that claimed to allow a normal user to
> > reboot the machine. It worked.
> >
> > The machine instantly rebooted, and on coming up there were a few
> > problems with the filesystem (fixed).
> >
> > Now, I cannot seem to find the article that described the problem
> (or
> > the huge thread that ensued). Also, I have not received a CERT
> advisory,
> > and there seems to be no information either in the Sun Manager's
> List
> > Archive, or on SunSolve.
> >
> > In the mean-time I have changed the permissions to only allow
> trusted
> > users to use ping, but I would prefer a slightly more formal
> response.
> >
> > Has anyone else any information on this issue?
> >
> > (as always, will summarize)
> >
> > TIA,
> >

Sun's latest patch (103169-12) fixes this, and several other TCP/IP
related problems.

Thanks to:-

Christopher L Barnard
Stephen Harris
Fletcher B Cocquyt
John D Groenveld
David Milun
Saeed Abubakar

--
Ross Golder
Technical Dept
CPD Ltd, Whetstone, London, N20 9LD.
Tel: +44 (0) 973 897671
mailto:rossg@cpd.co.uk (Work)
http://www.cpd.co.uk/~rossg



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:11:58 CDT