※ 本文轉錄自 [Lan] 信箱 作者: [email protected] (TWCERT/CC Fellows) 標題: 【TWCERT/CC安全通報】 TW-CA-2005-062-[Sun(sm) 時間: Fri May 27 10:10:59 2005 -----BEGIN PGP SIGNED MESSAGE----- TW-CA-2005-062-[Sun(sm) Alert Notification #57795: Security Vulnerability in the WU-FTPD 'wu_fnmatch' Function May Result in a Denial of Service (DoS)] ──────────────────────────────────────── TWCERT/CC發布日期：2005-05-27 原漏洞發布日期：2005-05-20 原漏洞最新更新日期：-- 通用安全漏洞編號： 分類：Dos, 來源參考：Sun(sm) Alert Notification #57795 ──── 簡述 ───────────────────────────────── ──── 說明 ───────────────────────────────── in.ftpd(1M) 是Solaris 9 與 Solaris 10 的 FTP 伺服器，此伺服器乃植基於 WU-FTPD (Washington University ftpd)，在 "wu_fnmatch" function 有個安全弱點可允許本地 端或遠端沒有權限的使用者能夠消耗大量的 CPU 資源，這是一種阻斷服務攻擊。 本安全議題可於下列網址獲得更多的相關資訊： CAN-2005-0256 -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0256 iDEFENSE Security Advisory 02.25.05 -http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities ──── 影響平台 ─────────────────────────────── 此議題可能影響下列發行版本： SPARC 平台 ‧Solaris 9 ‧Solaris 10 x86 平台 ‧Solaris 9 ‧Solaris 10 注意： 1. Solaris 7 與 Solaris 8 不受本安全議題影響。 2. 本安全議題只影響 "WU-FTPD" 版本的 in.ftpd(1M)。 3. 本安全議題只影響有啟動 in.ftpd(1M) 伺服器的系統。 ──── 修正方式 ─────────────────────────────── 暫時解決方法： 要暫時本安全議題的問題，請依下列方式關閉 ftp(1) 服務： 在 Solaris 9 1. 以 root 登入系統 2. 編輯 "/etc/inetd.conf" 檔案，並在註解掉 "ftp" 為開頭的地方。 3. 讓 inetd(1M) 程序以下列指令重新讀取新修改後的 "/etc/inetd.conf" 檔案： # pkill -HUP inetd 在 Solaris 10 1. 以 root 登入系統 2. 以下列指令關閉 in.ftpd(1M) 伺服器： # svcadm disable ftp Preliminary T-patches 可以下列網址取得： http://sunsolve.sun.com/tpatches SPARC 平台 ‧Solaris 9 T-patch T114564-05 x86 平台 ‧Solaris 9 T-patch T114565-05 解決方式： 最終的解決方式仍懸而未決。 ──── 影響結果 ─────────────────────────────── 當發生本安全議題所述的問題時，CPU 的使用率會高達 100% 而且 prstat(1M) 指令會顯 示 "in.ftpd" 程序占用了大部分的 CPU 時間。 其特徵如下所示： ‧顯示執行的應用程式 ‧在終端機會有回應遲緩的現象 ‧顯示回應會遍及整個網路 ──── 聯絡TWCERT/CC ───────────────────────────── Tel: 886-7-5250211 FAX: 886-7-5250212 886-2-23563303 886-2-23924082 Email: [email protected] URL: http://www.cert.org.tw/ PGP key: http://www.cert.org.tw/eng/pgp.htm ──────────────────────────────────────── 附件：[Security Vulnerability in the WU-FTPD 'wu_fnmatch' Function May Result in a Denial of Service (DoS)] ──── 原文 ───────────────────────────────── Sun(sm) Alert Notification Sun Alert ID: 101699 (formerly 57795) Synopsis: Security Vulnerability in the WU-FTPD "wu_fnmatch" Function May Result in a Denial of Service (DoS) Category: Security Product: Solaris 9 Operating System, Solaris 10 Operating System BugIDs: 6239487 Avoidance: T-Patch, Workaround State: Workaround Date Released: 20-May-2005 Date Closed: Date Modified: 23-May-2005 1. Impact The Solaris 9 and Solaris 10 FTP Server, in.ftpd(1M), is based on WU-FTPD (Washington University ftpd) and are affected by a security vulnerability in the "wu_fnmatch" function which may allow a local or remote unprivileged user the ability to cause a Denial of Service (DoS) by consuming a large amount of CPU resources. Additional information on this issue can be found in the following documents: CAN-2005-0256 (see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0256) iDEFENSE Security Advisory 02.25.05 (see: http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities) 2. Contributing Factors This issue can occur in the following releases: SPARC Platform Solaris 9 Solaris 10 x86 Platform Solaris 9 Solaris 10 Notes: Solaris 7 and Solaris 8 are not affected by this issue. This issue only impacts the "WU-FTPD" version of in.ftpd(1M). This issue only affects systems which are enabled as in.ftpd(1M) servers. 3. Symptoms If the described issue occurs, the CPU utilization will go up to 100% and the prstat(1M) command will show that the "in.ftpd" process is consuming a lot of CPU time. Symptoms similar to the following may be seen: Slow running applications Delayed response from the terminals Slow response over the network Solution Summary Top 4. Relief/Workaround To work around the described issue, disable ftp(1) service by doing the following: On Solaris 9 1. Login as root. 2. Edit the "/etc/inetd.conf" file and comment out the line starting with "ftp". 3. Tell the inetd(1M) process to reread the newly modified "/etc/inetd.conf" file by sending it a hangup signal, SIGHUP: # pkill -HUP inetd On Solaris 10 1. Login as root. 2. Disable the in.ftpd(1M) server using the following command: # svcadm disable ftp Preliminary T-patches are available for the following releases from: http://sunsolve.sun.com/tpatches: SPARC Solaris 9 T-patch T114564-05 x86 Platform Solaris 9 T-patch T114565-05 5. Resolution A final resolution is pending completion. Change History 23-May-2005: Updated Relief/Workaround section This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. ──────────────────────────────────────── -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQEVAwUBQpaAzKcyQYefg2/NAQF7rwf+Lb80zNGLIy5Rw5MV3MUtBjoMnJepVekQ Ffh6DHo8Y1rI//qIREM26LI+amIbmtrGYy0k8fI1PfMAaWc03lWEY6ebL1sB4fdV gKOX8+PJ5STzwWMfF51qO0NhGLTzqlCtA/rssMC3WEvVI1koHeN62DrgcdjQNTVo Wng3hYvpaRQkjphbuUFOAAhlj9O0l3JSGQQAKQSjKwz/ySjJM6nAzOptoyNO9RIv Pf0NkB3uKzuAsNfA40KKpMXXsj1TNsly7ZWXQCbFHrGvlxFylXezz6RSyHQsvHjL PfOo79womJ3ZRgXq0tMxvHqHfM+SumGMtdk20slxL98bM4KQLqXLJA== =1Of2 -----END PGP SIGNATURE----- -- Taiwan Computer Emergency Response Team Security Advisory mailing list. Mail to : [email protected] and include a line "subscribe advisory". Please visit http://www.cert.org.tw/. PGP key : http://www.cert.org.tw/eng/pgp.htm