※ 本文转录自 [Lan] 信箱 作者: [email protected] (TWCERT/CC Fellows) 标题: 【TWCERT/CC安全通报】 TW-CA-2005-062-[Sun(sm) 时间: Fri May 27 10:10:59 2005 -----BEGIN PGP SIGNED MESSAGE----- TW-CA-2005-062-[Sun(sm) Alert Notification #57795: Security Vulnerability in the WU-FTPD 'wu_fnmatch' Function May Result in a Denial of Service (DoS)] ──────────────────────────────────────── TWCERT/CC发布日期：2005-05-27 原漏洞发布日期：2005-05-20 原漏洞最新更新日期：-- 通用安全漏洞编号： 分类：Dos, 来源参考：Sun(sm) Alert Notification #57795 ──── 简述 ───────────────────────────────── ──── 说明 ───────────────────────────────── in.ftpd(1M) 是Solaris 9 与 Solaris 10 的 FTP 伺服器，此伺服器乃植基於 WU-FTPD (Washington University ftpd)，在 "wu_fnmatch" function 有个安全弱点可允许本地 端或远端没有权限的使用者能够消耗大量的 CPU 资源，这是一种阻断服务攻击。 本安全议题可於下列网址获得更多的相关资讯： CAN-2005-0256 -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0256 iDEFENSE Security Advisory 02.25.05 -http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities ──── 影响平台 ─────────────────────────────── 此议题可能影响下列发行版本： SPARC 平台 ‧Solaris 9 ‧Solaris 10 x86 平台 ‧Solaris 9 ‧Solaris 10 注意： 1. Solaris 7 与 Solaris 8 不受本安全议题影响。 2. 本安全议题只影响 "WU-FTPD" 版本的 in.ftpd(1M)。 3. 本安全议题只影响有启动 in.ftpd(1M) 伺服器的系统。 ──── 修正方式 ─────────────────────────────── 暂时解决方法： 要暂时本安全议题的问题，请依下列方式关闭 ftp(1) 服务： 在 Solaris 9 1. 以 root 登入系统 2. 编辑 "/etc/inetd.conf" 档案，并在注解掉 "ftp" 为开头的地方。 3. 让 inetd(1M) 程序以下列指令重新读取新修改後的 "/etc/inetd.conf" 档案： # pkill -HUP inetd 在 Solaris 10 1. 以 root 登入系统 2. 以下列指令关闭 in.ftpd(1M) 伺服器： # svcadm disable ftp Preliminary T-patches 可以下列网址取得： http://sunsolve.sun.com/tpatches SPARC 平台 ‧Solaris 9 T-patch T114564-05 x86 平台 ‧Solaris 9 T-patch T114565-05 解决方式： 最终的解决方式仍悬而未决。 ──── 影响结果 ─────────────────────────────── 当发生本安全议题所述的问题时，CPU 的使用率会高达 100% 而且 prstat(1M) 指令会显 示 "in.ftpd" 程序占用了大部分的 CPU 时间。 其特徵如下所示： ‧显示执行的应用程式 ‧在终端机会有回应迟缓的现象 ‧显示回应会遍及整个网路 ──── 联络TWCERT/CC ───────────────────────────── Tel: 886-7-5250211 FAX: 886-7-5250212 886-2-23563303 886-2-23924082 Email: [email protected] URL: http://www.cert.org.tw/ PGP key: http://www.cert.org.tw/eng/pgp.htm ──────────────────────────────────────── 附件：[Security Vulnerability in the WU-FTPD 'wu_fnmatch' Function May Result in a Denial of Service (DoS)] ──── 原文 ───────────────────────────────── Sun(sm) Alert Notification Sun Alert ID: 101699 (formerly 57795) Synopsis: Security Vulnerability in the WU-FTPD "wu_fnmatch" Function May Result in a Denial of Service (DoS) Category: Security Product: Solaris 9 Operating System, Solaris 10 Operating System BugIDs: 6239487 Avoidance: T-Patch, Workaround State: Workaround Date Released: 20-May-2005 Date Closed: Date Modified: 23-May-2005 1. Impact The Solaris 9 and Solaris 10 FTP Server, in.ftpd(1M), is based on WU-FTPD (Washington University ftpd) and are affected by a security vulnerability in the "wu_fnmatch" function which may allow a local or remote unprivileged user the ability to cause a Denial of Service (DoS) by consuming a large amount of CPU resources. Additional information on this issue can be found in the following documents: CAN-2005-0256 (see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0256) iDEFENSE Security Advisory 02.25.05 (see: http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities) 2. Contributing Factors This issue can occur in the following releases: SPARC Platform Solaris 9 Solaris 10 x86 Platform Solaris 9 Solaris 10 Notes: Solaris 7 and Solaris 8 are not affected by this issue. This issue only impacts the "WU-FTPD" version of in.ftpd(1M). This issue only affects systems which are enabled as in.ftpd(1M) servers. 3. Symptoms If the described issue occurs, the CPU utilization will go up to 100% and the prstat(1M) command will show that the "in.ftpd" process is consuming a lot of CPU time. Symptoms similar to the following may be seen: Slow running applications Delayed response from the terminals Slow response over the network Solution Summary Top 4. Relief/Workaround To work around the described issue, disable ftp(1) service by doing the following: On Solaris 9 1. Login as root. 2. Edit the "/etc/inetd.conf" file and comment out the line starting with "ftp". 3. Tell the inetd(1M) process to reread the newly modified "/etc/inetd.conf" file by sending it a hangup signal, SIGHUP: # pkill -HUP inetd On Solaris 10 1. Login as root. 2. Disable the in.ftpd(1M) server using the following command: # svcadm disable ftp Preliminary T-patches are available for the following releases from: http://sunsolve.sun.com/tpatches: SPARC Solaris 9 T-patch T114564-05 x86 Platform Solaris 9 T-patch T114565-05 5. Resolution A final resolution is pending completion. Change History 23-May-2005: Updated Relief/Workaround section This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. ──────────────────────────────────────── -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQEVAwUBQpaAzKcyQYefg2/NAQF7rwf+Lb80zNGLIy5Rw5MV3MUtBjoMnJepVekQ Ffh6DHo8Y1rI//qIREM26LI+amIbmtrGYy0k8fI1PfMAaWc03lWEY6ebL1sB4fdV gKOX8+PJ5STzwWMfF51qO0NhGLTzqlCtA/rssMC3WEvVI1koHeN62DrgcdjQNTVo Wng3hYvpaRQkjphbuUFOAAhlj9O0l3JSGQQAKQSjKwz/ySjJM6nAzOptoyNO9RIv Pf0NkB3uKzuAsNfA40KKpMXXsj1TNsly7ZWXQCbFHrGvlxFylXezz6RSyHQsvHjL PfOo79womJ3ZRgXq0tMxvHqHfM+SumGMtdk20slxL98bM4KQLqXLJA== =1Of2 -----END PGP SIGNATURE----- -- Taiwan Computer Emergency Response Team Security Advisory mailing list. Mail to : [email protected] and include a line "subscribe advisory". Please visit http://www.cert.org.tw/. PGP key : http://www.cert.org.tw/eng/pgp.htm