Solaris systems may crash in response to certain IPv6 packets

2003-07-23T00:00:00
ID VU:370060
Type cert
Reporter CERT
Modified 2003-07-23T17:06:00

Description

Overview

Solaris 8 systems that accept IPv6 traffic may be subject to denial of service attacks from arbitrary remote attackers.

Description

Sun Microsystems has reported that systems running Solaris 8 may encounter a system panic in response to IPv6 packets with certain characteristics. Sun Alert Notification 55301 does not provide any information about the characteristics of the offending packet, so it may be possible to exploit this vulnerability with valid IPv6 traffic. Sun Microsystems reports that this vulnerability does not affect systems running Solaris 2.6, Solaris 7, and Solaris 9.

For additional information, please read the Sun Alert Notification 55301, available at:

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F55301&zone_32=category%3Asecurity


Impact

This vulnerability allows arbitrary remote attackers to conduct denial of service attacks on affected systems.


Solution

Apply a patch

Sun Microsystems has provided the following patches to address this vulnerability:

For the SPARC Platform, apply patch 108528
For the x86 Platform, apply patch 108529


Disable IPv6

As a general rule, the CERT/CC recommends that users and site administrators disable any services that are not required. For information on disabling IPv6 on affected Solaris systems, please read the "Relief/Workaround" section of Sun Alert Notification 55301.


Vendor Information

370060

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Sun Microsystems Inc. __ Affected

Notified: July 21, 2003 Updated: July 23, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Sun Microsystems has published Sun Alert Notification 55301 to address this vulnerability. For further information, please see:

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F55301&zone_32=category%3Asecurity

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | |
Temporal | |
Environmental | |

References

Acknowledgements

This document was written by Jeffrey P. Lanza and is based on information provided by Sun Microsystems.

Other Information

CVE IDs: | None
---|---
Severity Metric: | 25.20
Date Public: | 2003-07-21
Date First Published: | 2003-07-23
Date Last Updated: | 2003-07-23 17:06 UTC
Document Revision: | 8