—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgendes Sun Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.

6781539 – Schwachstelle in vntsd(1M)

Im Solaris Virtual Network Terminal Server Daemon (vntsd(1M)) befindet
sich eine nicht naeher beschriebene Schwachstelle, durch die ein
unprivilegierter Benutzer aus der Control Logical Domain auf die
Konsole einer Guest Logical Domain zugreifen kann.

Betroffen sind die folgenden Software Pakete und Plattformen:

Solaris 10
OpenSolaris

SPARC Plattform
* Solaris 10 ohne Patch 141778-01 oder neuer
* OpenSolaris basierend auf Builds snv_109 oder neuer

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

Hersteller Advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-262708-1

(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
Klaus Moeller, DFN-CERT

– —
Dipl. Inform. Klaus Moeller (Incident Response Team)
Phone: +49 40 808077-555, Fax: +49 40 808077-556

DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrase 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

Solution Type Sun Alert
Solution 262708 : Security Vulnerability in the Virtual Network
Terminal Server Daemon (vntsd(1M)) for Logical Domains (LDoms) May
Allow Unauthorized Access to Guest Domain Console
Related Categories

* Home>Content>Sun Alert Criteria Categories>Security
* Home>Content>Sun Alert Release Phase>Resolved

Bug ID
6781539

Product
Solaris 10 Operating System
OpenSolaris

Date of Resolved Release
25-Jun-2009

SA Document Body
Security Vulnerability in the Virtual Network Terminal Server Daemon (vntsd(1M)
) … see below:

1. Impact

A security vulnerability in the Solaris Virtual Network Terminal Server
daemon (vntsd(1M)) for Logical Domains (LDoms) may allow local
unprivileged users within the control domain to gain unauthorized
access to the console of a guest domain.

2. Contributing Factors

SPARC Platform
* Solaris 10 without patch 141778-01
* OpenSolaris based upon builds snv_41 through snv_108

Notes: Solaris 8 and Solaris 9 are not affected as they do not support
LDoms.

Solaris on the x86 Platform is not affected by this issue as Logical
Domains (LDoms)
software is supported only on the SPARC Platform.

3. Symptoms

There are no predictable symptoms to indicate that this issue has been
exploited to gain unauthorized console access to guest domains.

4. Workaround

Until the resolution patches are applied, it is possible to
workaround this issue via one of the following options:
1. Disable console access to the guest domains. This may be
done by executing the following command:
ldmctrl:#> svcadm disable vntsd

2. Allow console access to guest domains only from a separate sparse
root zone.
This may be done by executing the following commands:
ldmctrl:#> svcadm disable vntsd
ldmctrl:#> svccfg -s vntsd setprop vntsd/listen_addr =
ldmctrl:#> svcadm refresh vntsd
ldmctrl:#> svcadm enable vntsd

Firewall rules may be required to allow access only from the
sparse root zone to the ports used by the vntsd(1M) daemon.
Refer to firewall documentation for more information on configuring the
tool.

5. Resolution

This issue is addressed in the following releases:
SPARC Platform
* Solaris 10 with patch 141778-01 or later
* OpenSolaris based upon builds snv_109 or later

For more information on Security Sun Alerts, see Technical Instruction ID 21355
7
http://sunsolve.sun.com/search/document.do?assetkey=1-61-213557-1

This Sun Alert notification is being provided to you on an “AS IS”
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.
Attachments
This solution has no attachment

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFKSgBdk0kIxZMiiQ8RAjwnAKCdyAWjH45GTbTp4yDVNJQbJ7PByQCgm8zb
ZJ94735wcpW2Yrjop+N2QRo=
=I0sv
—–END PGP SIGNATURE—–