Junglewise Threat Intelligence

CVE-1999-1423: Sun Solaris denial of service in ping utility

CVE-1999-1423 · Severity: low · CVSS 2.1 · Published 1997-06-26

Vendors: Sun Microsystems.

Executive brief

A vulnerability in the ping utility of older Solaris operating systems allows a local user to crash the entire system. By sending a specific type of network request to a multicast address through the internal loopback interface, an attacker can trigger a system reboot or kernel panic. This results in a total loss of availability for the affected server and any services it hosts.

Technical details

The ping utility in Solaris 2.3 through 2.6 contains a flaw in how it handles multicast requests directed through the loopback interface. A local, unprivileged user can execute 'ping -i' (or similar flags depending on the version) targeting a multicast address like 224.0.0.1 via the 127.0.0.1 interface to trigger a kernel panic or immediate reboot. This is possible because the ping binary is typically setuid root. Workarounds include disabling the setuid bit on the ping binary, using ndd to set ip_respond_to_echo_broadcast to 0, or applying vendor-provided patches from Sun (Bug ID 1226919).

Affected products

  • Sun Microsystems Solaris 2.3, 2.4, 2.5, 2.5.1, 2.6

Timeline

  • 1997-06-26: disclosed: Initial disclosure on Bugtraq mailing list
  • 1997-06-26: advisory: NVD publication date

References