Search:

May 2005

Sun Alert Notification 57786 - automountd(1M) May Stop When Accessing /xfn/_x500

ID: 00403
Ref: 373/2005
Date: 12 May 2005:14:57:52
Version: 1

Title: Sun Alert Notification 57786 - automountd(1M) May Stop When Accessing /xfn/_x500
Abstract: A local unprivileged user may be able to create a denial of service by killing the automountd(1M) daemon. This would affect all applications that utilize autofs(4) file systems which are automatically mounted by the automountd(1M) daemon.
Vendors affected: Sun
Operating systems affected: Sun
Applications affected: Sun

Title
=====

Sun Alert Notification 57786 - automountd(1M) May Stop When Accessing "/xfn/_x500"

Detail
======

A local unprivileged user may be able to create a denial of
service by killing the automountd(1M) daemon. This would affect all
applications that utilize autofs(4) file systems which are
automatically mounted by the automountd(1M) daemon.

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================

ESB-2005.0380 -- Sun Alert Notification 57786
automountd(1M) May Stop When Accessing "/xfn/_x500"
12 May 2005

===========================================================================

Product: Solaris
Publisher: Sun Microsystems
Operating System: Solaris 9/8/7
Impact: Denial of Service
Access: Existing Account

Original Bulletin:
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-57786-1

- - --------------------------BEGIN INCLUDED TEXT--------------------

Sun(sm) Alert Notification
* Sun Alert ID: 57786
* Synopsis: automountd(1M) May Stop When Accessing "/xfn/_x500"
* Category: Security
* Product: Solaris
* BugIDs: 4807798
* Avoidance: Workaround, Patch
* State: Resolved
* Date Released: 10-May-2005
* Date Closed: 10-May-2005
* Date Modified:

1. Impact A local unprivileged user may be able to create a denial of
service by killing the automountd(1M) daemon. This would affect all
applications that utilize autofs(4) file systems which are
automatically mounted by the automountd(1M) daemon.

2. Contributing Factors This issue can occur in the following
releases:

SPARC Platform

* Solaris 7 without patch 119423-01
* Solaris 8 without patch 116997-01
* Solaris 9 without patch 117485-01

x86 Platform

* Solaris 7 without patch 119424-01
* Solaris 8 without patch 116998-01
* Solaris 9 without patch 117486-01

Note: Solaris 10 does not have Federated Naming Services (FNS) and is
not impacted by this issue.

The described issue only occurs if all of the following conditions are
true:

1. Federated Naming Services (FNS) support for X.500 directory
context is installed
2. Federated Naming Services (FNS) is enabled in "/etc/auto_master"
(This is the default)
3. autofs(4) is installed and started at boot (This is the default)
4. FNS X.500 configuration (/etc/fn/x500.conf) references a valid
LDAP server. By default the configuration includes a server named
"ldap"

To determine if FNS support for X.500 directory context is installed,
the following command can be run:

$ pkginfo SUNWfnsx5
system SUNWfnsx5 FNS Support For X.500 Directory Context

To determine if FNS is enabled in "/etc/auto_master", the following
command can be run:

$ grep /xfn /etc/auto_master
/xfn -xfn

To determine if autofs(4) is installed and started at boot, the
following command can be run:

$ pkginfo SUNWatfsu
system SUNWatfsu AutoFS, (Usr)
$ ls /etc/rc2.d/S74autofs
/etc/rc2.d/S74autofs

To determine if FNS X.500 configuration references a valid LDAP
server, the following command can be run:

$ grep ldap /etc/fn/x500.conf
# x500-access:
# ldap-servers:
x500-access: xds ldap
ldap-servers: localhost ldap

$ getent hosts ldap
64.124.140.199 ldap.sun.com

Note: This issue is very rarely encountered even on systems that meet
all of the conditions listed above.

3. Symptoms If the described issue occurs, the automountd(1M) process
is absent. This can be seen by using the pgrep(1m) command:

$ pgrep automountd || echo "automountd process NOT found!"

In general, processes or applications attempting to access files or
directories that rely on autofs(4) may fail with error messages such
as "no such file or directory" or "does not exist". As an example, the
Bourne shell (/usr/bin/sh) attempting to change directory to a known
autofs(4) path would result in the following:

$ cd /share/local
/share/local: does not exist

Solution Summary

4. Relief/Workaround To work around the described issue, one of the
following options can be applied:

Option 1

Restart automountd(1M) using the following command as root:

# pgrep automountd || /etc/init.d/autofs start

The following simple Bourne script will check and restart
automountd(1M) as necessary:

# while pgrep automountd || /etc/init.d/autofs start; do sleep 10; done

Option 2

If FNS X.500 is not intended to be used with LDAP, remove the server
name "ldap" from the "/etc/fn/x500.conf" file.

Option 3

Remove the "/xfn" entry from the "auto_master" mapfile (either in
files or NIS, NIS+, or LDAP).

Option 4

If FNS is not being used, remove the FNS packages:

SUNWfns Federated Naming System
SUNWfnsx Federated Naming System (64-bit)
SUNWfnsx5 FNS Support For X.500 Directory Context

Refer to the pkgrm(1M) command for additional information on removing
packages.

5. Resolution This issue is addressed in the following releases:

SPARC Platform

* Solaris 7 with patch 119423-01 or later
* Solaris 8 with patch 116997-01 or later
* Solaris 9 with patch 117485-01 or later

x86 Platform

* Solaris 7 with patch 119424-01 or later
* Solaris 8 with patch 116998-01 or later
* Solaris 9 with patch 117486-01 or later

This Sun Alert notification is being provided to you on an "AS IS"
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
This Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.

Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.

- - --------------------------END INCLUDED TEXT--------------------

iQCVAwUBQoKTBih9+71yA2DNAQK0UwP8DmULW5CcT1yVIBGCUYhQLj1UMnEjP1oy
inNk/E62k6Bi+wxzmymXfI7THERawrNnrBfZM3jIqkRnms1qB/ZLioRYfpfCKF7S
2EBOrI/7f1jkqjExckJs7fggeVdeBbpgtW6q7KXSlfOtLxdNprBA4vFh5F20poD5
eD8RFELQnos=
=rMr+
- -----END PGP SIGNATURE-----