Sun Solaris TCP denial of service

sunsolaris-tcp-dos (42264) The risk level is classified as LowLow Risk

Description:

Sun Solaris is vulnerable to a denial of service, caused by an error within the TCP implementation. By flooding the system with TCP SYN packets, a remote attacker could cause the network connection to time out before making a connection or consume an overly large amount of CPU resources, resulting in a denial of service.

Platforms Affected:

  • Sun, Solaris 10 x86
  • Sun, Solaris 10 SPARC
  • Sun, Solaris 8.0 SPARC
  • Sun, Solaris 8.0 x86
  • Sun, Solaris 9.0 SPARC
  • Sun, Solaris 9.0 x86

Remedy:

Refer to Sun Alert ID: 200864 for patch, upgrade or suggested workaround information. See References.

Consequences:

Denial of Service

References:

  • NORTEL BULLETIN ID: 2008008915, Rev 1, Nortel Response to Sun Alert 200864 - Solaris DoS Under a TCP "SYN Flood" Attack at http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=736664.
  • Sun Alert ID: 200864, Security Vulnerability in the TCP Implementation of Solaris Systems May Allow a Denial of Service When Accepting New Connections While Undergoing a TCP "SYN Flood" Attack at http://sunsolve.sun.com/search/document.do?assetkey=1-66-200864-1.
  • ASA-2008-206: Security Vulnerability in the TCP Implementation of Solaris Systems (Sun 200864)
  • BID-29089: Sun Solaris TCP SYN Flooding Remote Denial of Service Vulnerability
  • CVE-2008-2121: The TCP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to cause a denial of service (CPU consumption and new connection timeouts) via a TCP SYN flood attack.
  • FrSIRT/ADV-2008-1453: Sun Solaris TCP Implementation Remote Denial of Service Vulnerability
  • FrSIRT/ADV-2008-1585: Avaya CMS and IR Solaris Remote Denial of Service Vulnerability
  • SA30125: Avaya CMS Solaris TCP Implementation SYN Flood Denial of Service
  • SA30131: Sun Solaris TCP Implementation SYN Flood Denial of Service
  • SECTRACK ID: 1019989: Solaris TCP SYN Attack Protection Bug Lets Remote Users Deny Service

Reported:

May 06, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page