Philip Kizer wrote:
> Adam Caldwell <adam@ATL.ENI.NET> wrote:
> >I briefly searched the bugtraq archives and didn't see this one, so
> here's a
> >way to reboot a Solaris box, and is exploitable by anyone with an
> account on
> >the system since ping is setuid root.
>
> For those with access, Sun seems to have Bug Id: 1226919 open on the
> issue.
>
> >ping -sv -i 127.0.0.1 224.0.0.1
> >
> >On solaris 2.5, causes the machine to reboot (personal experience).
> I've
> >had independent reports of it crashing 2.5.1, and 2.5 (x86). It
> probably works
> >on all versions of Solaris.
> >
> >To "fix" the denial of service:
> >chmod go-x /usr/sbin/ping
> >if you don't mind disabling Ping on your system.
>
> In my quick testing, it seems that there is another workaround if:
>
> 1: You do not require multicast support, and
> 2: Have the opportunity to reboot your machine.
>
> Just comment out the "route add 224.0.0.0 ..." in /etc/init.d/inetsvc
> and
> reboot. Even just doing the 'route delete 224.0.0.0 ...' still
> allowed the
> panic.
>
> _________________________________________________________ Philip Kizer
> ______
>
> pckizer@nostrum.com