Re: solaris nscd cores

From: j.e.r.k. ROCKS (jerkrockat_private)
Date: Tue Dec 04 2001 - 06:33:19 PST

  • Next message: Florian Weimer: "Re: Attacks against SSH?"

       Hmmm.... I need to get better gdb output, but here is a preliminary
    look...
    
    Core was generated by `/usr/sbin/nscd'.
    Program terminated with signal 9, Killed.
    (gdb) bt
    #0  0xef7663d8 in ?? () from /usr/lib/libresolv.so.2
    #1  0xef7667bc in ?? () from /usr/lib/libresolv.so.2
    #2  0xef765b40 in ?? () from /usr/lib/libresolv.so.2
    #3  0xef76a6f4 in ?? () from /usr/lib/libresolv.so.2
    #4  0xef76b2e8 in ?? () from /usr/lib/libresolv.so.2
    #5  0xef4c0bf0 in ?? () from /usr/lib/nss_dns.so.1
    #6  0xef4c0d98 in ?? () from /usr/lib/nss_dns.so.1
    #7  0xef5d5244 in ?? () from /usr/lib/libc.so.1
    #8  0xef6b0a84 in ?? () from /usr/lib/libnsl.so.1
    #9  0xef6af64c in ?? () from /usr/lib/libnsl.so.1
    #10 0x1655c in gethost_lookup ()
    #11 0x133d8 in switcher ()
    
    --- mikeDOTd <mikedotdat_private> wrote:
    > 	I saw a number of nscd crashes thursday-friday on my sun.
    > 
    > 	I have a full core, and initially I see this:
    > 
    > Core was generated by `/usr/sbin/nscd'.
    > Program terminated with signal 9, Killed.
    > #0  0xef7563d8 in ?? ()
    > 
    > 	If I find anything else I'll post to the list.
    > 
    > 
    > --mikeDOTd
    > mikedotdat_private
    > http://www.nexthop.net/~mikedotd
    > 
    > pub DH/DSS http://www.nexthop.net/~mikedotd/0xC8D39AC8.asc
    > Key fingerprint: 355D E9FA 2C25 93A9 877F  D9F3 6925 E0A9 C8D3 9AC8
    > 
    > On Fri, 30 Nov 2001, j.e.r.k. ROCKS wrote:
    > 
    > >
    > >   Has anyone else seen core dumps from their Solaris nscd process
    > > recently?  At 11:07 CST yesterday, two different Internet-facing
    > > machines in my network saw their nscd processes dump core.  The
    > file
    > > system filled up in both cases, so I actually didn't get a full
    > core
    > > file.  GDB tells me:
    > >
    > > Core was generated by `/usr/sbin/nscd'.
    > > Program terminated with signal 9, Killed.
    > > Cannot access memory at address 0xef7efdec.
    > > #0  0xef7663d8 in ?? ()Cannot access memory at address 0xef7efdec.
    > > (gdb) bt
    > > #0  0xef7663d8 in ?? ()Cannot access memory at address 0xef7efdec.
    > >
    > >
    > > I am running with patch 109339-01, which fixes a mysterious buffer
    > > overflow bug in nscd (Sun released a proactive advisory back in
    > > November 2000, along with this patch), but this definitely makes me
    > > nervous.  Has anyone else encountered this issue?
    > >
    > >
    > > __________________________________________________
    > > Do You Yahoo!?
    > > Yahoo! GeoCities - quick and easy web site hosting, just
    > $8.95/month.
    > > http://geocities.yahoo.com/ps/info1
    > >
    > >
    >
    ----------------------------------------------------------------------------
    > > This list is provided by the SecurityFocus ARIS analyzer service.
    > > For more information on this free incident handling, management
    > > and tracking system please see: http://aris.securityfocus.com
    > >
    > 
    
    
    __________________________________________________
    Do You Yahoo!?
    Buy the perfect holiday gifts at Yahoo! Shopping.
    http://shopping.yahoo.com
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Dec 04 2001 - 10:55:00 PST