Executive brief
A vulnerability in the AIX operating system's network service manager (inetd) can allow remote attackers to crash or significantly slow down a server. By repeatedly connecting to an unintended network port opened by the system, an attacker can exhaust system memory and CPU resources. This can lead to a total service outage requiring a physical reboot to recover.
Technical details
A flaw exists in the inetd daemon of AIX 4.1.5 related to how it handles dynamic port assignment for the ToolTalk server (ttdbserver). When ttdbserver is assigned a dynamic port N, inetd incorrectly begins listening on port N-1 without an associated service handler. A remote, unauthenticated attacker can exploit this by initiating a large volume of TCP connections to port N-1. Because inetd does not properly close these connections or pass control to a sub-process, the system accumulates connections in a CLOSE_WAIT state, leading to mbuf exhaustion, high CPU usage in the 'gil' kernel thread, and eventual system hang or crash. The issue is resolved by applying the inetd patch IX70400 (fileset bos.net.tcp.client 4.1.5.12).
Affected products
- IBM AIX 4.1.5
Timeline
- 1998-03-18: disclosed: Public disclosure on Bugtraq mailing list
- 1998-03-18: advisory: NVD publication date
- 1998-03-18: patched: IBM fix IX70400 confirmed available at time of disclosure