Vulnerabilities > CVE-2009-0925 - Resource Management Errors vulnerability in SUN Opensolaris and Solaris

CVSS 4.7 - MEDIUM

Attack vector

LOCAL

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

COMPLETE

local

sun

CWE-399

NVD

Published: 2009-03-17

Updated: 2017-08-17

Summary

Unspecified vulnerability in Sun Solaris 10 on SPARC sun4v systems, and OpenSolaris snv_47 through snv_85, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6425723.

Vulnerable Configurations

Part	Description	Count
OS	Sun SUN Opensolaris Snv_10 SUN Opensolaris Snv_47 SUN Opensolaris Snv_48 SUN Opensolaris Snv_49 SUN Opensolaris Snv_50 SUN Opensolaris Snv_51 SUN Opensolaris Snv_52 SUN Opensolaris Snv_53 SUN Opensolaris Snv_54 SUN Opensolaris Snv_55 SUN Opensolaris Snv_56 SUN Opensolaris Snv_57 SUN Opensolaris Snv_58 SUN Opensolaris Snv_59 SUN Opensolaris Snv_60 SUN Opensolaris Snv_61 SUN Opensolaris Snv_62 SUN Opensolaris Snv_63 SUN Opensolaris Snv_64 SUN Opensolaris Snv_65 SUN Opensolaris Snv_66 SUN Opensolaris Snv_67 SUN Opensolaris Snv_68 SUN Opensolaris Snv_69 SUN Opensolaris Snv_70 SUN Opensolaris Snv_71 SUN Opensolaris Snv_72 SUN Opensolaris Snv_73 SUN Opensolaris Snv_74 SUN Opensolaris Snv_75 SUN Opensolaris Snv_76 SUN Opensolaris Snv_77 SUN Opensolaris Snv_78 SUN Opensolaris Snv_79 SUN Opensolaris Snv_80 SUN Opensolaris Snv_81 SUN Opensolaris Snv_82 SUN Opensolaris Snv_83 SUN Opensolaris Snv_84 SUN Opensolaris Snv_85 SUN Solaris 10.0	41

Common Weakness Enumeration (CWE)

CWE-399 - Resource Management Errors

Seebug

bulletinFamily	exploit
description	BUGTRAQ ID: 34137 CVE(CAN) ID: CVE-2009-0924,CVE-2009-0925,CVE-2009-0926 Solaris是一款由Sun开发和维护的商业UNIX操作系统。 Solaris系统UFS文件系统中有关ufs_getpage()和ufs_putpage()例程的安全漏洞可能导致系统挂起或忙碌，每个漏洞的具体影响如下： CR 6442712 在以64位模式运行OpenSolaris snv_39到snv_45的x86系统上，本地非特权用户可以导致所有对UFS文件系统的写入挂起，之后无法继续运行应用程序和命令；此外，如果root（/）文件系统为UFS，还可以导致系统挂起。 CR 6425723 在SPARC sun4v系统上，如果所运行的Solaris 10安装了138888-01补丁或之后版本且没有安装139483-05补丁，或在运行OpenSolaris snv_47到snv_85，则本地非特权用户可以导致所有对UFS文件系统的写入挂起，之后无法继续运行应用程序和命令，这是一种拒绝服务；此外，如果root（/）文件系统为UFS，还可以导致系统挂起。 CR 6679732 如果x86系统在以32位模式运行OpenSolaris snv_86到snv_91且至少存在一个UFS文件系统，则本地非特权用户可以导致忙碌。当出现6442712和6425723漏洞时，挂起的内核线程栈类似于： bmap_write+0x50() ufs_getpage+0x438() fop_getpage+0x44() segmap_getmapflt+0x588() wrip+0x63c() ufs_write+0x580() fop_write+0x20() write+0x268() syscall_trap32+0xcc() 6679732忙碌漏洞栈类似于： vcmn_err+16() real_panic_v+10c() ufs_fault_v+104() ufs_fault+3a() ufs_putapage+596() ufs_putpages+2a9() ufs_putpage+16c() fop_putpage+49() segmap_release+2da() wrip+8d4() ufs_write+4d2() fop_write+4a() 并生成以下形式的忙碌消息： ufs_putapage: bn == UFS_HOLE Sun Solaris 10.0 Sun OpenSolaris 临时解决方法：如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： * 向/etc/system文件添加以下项并重启系统： set segmap_kpm = 0x0 厂商补丁： Sun --- Sun已经为此发布了一个安全公告（Sun-Alert-254628）以及相应补丁: Sun-Alert-254628：Security Vulnerabilities in the UFS File System Relating to ufs_getpage() and ufs_putpage() Routines May Allow a Local User to Hang or Panic the System 链接：<a href=http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-254628-1 target=_blank rel=external nofollow>http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-254628-1</a>
id	SSV:4939
last seen	2017-11-19
modified	2009-03-23
published	2009-03-23
reporter	Root
title	Sun Solaris UFS文件系统多个本地拒绝服务漏洞

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Seebug

References