Re: Serious hole in Solaris 2.5[.1] gethostbyname() (exploit

[newsham () aloha net (Tim Newsham)]

> > The exploit does not work on my 2.5.1 Ultra-1.  Presumably this is
> > just a matter of getting the machine code right for the platform. ;)
>
> According to Dave Miller (Linux sparc guru) the I & D caches on the ultra
> are not coherent, so you'll need to find a way to flush the I cache.

Cache coherency is not the problem here.  The
exploit uses an opcode (twice) that causes an illegal
instruction exception on sun4u.  Replacing the
instruction with something appropriate for sun4u
results in a working exploit.  The instruction is
the "ta" instruction, a working opcode is "ta 8" for
both occurances.

> Alan

                                Tim N.