Mailing List Archive

Re: Nessus Destroying SunLink Service
Greetings,

I was just browsing list emails, found this email regarding SunLink Service. I had same problem with Sun 2.6 few days back.

The solution for this problem is that you kill the associated process "fs" and then kill -9 inetd and start it again, But beware that you dont kill it if not on the system console or serial cable.

The problem came on 2.6 only not on 2.8.

Regards,
Faiz

Greetings,
If anyone has seen problems similar to the following, we'd appreciate
any feedback you can provide.


We recently ran nessus against one of our subnets and promptly crashed
several MQ-Series servers running SunLink. Although the nessus DoS
plugins were turned OFF, the affected servers dropped LU6.2 sessions
with their hosts and all open SunLink Controller Windows reported an
endless succession of error messages until the systems were halted and
the platforms rebooted.

Subsequent lab testing confirmed that this happens every time nessus us
run and indicates two plugins are causing the problems:
find_services.nes and bind_zxfr_bug.nasl. Turning just these two
plugins off eliminates the problem and turning ONLY these two on crashes
SunLink every time nessus is run. Running the tool with only
find_services.nes enabled produces the symptoms above. Using it with
only the bind_zxfr_bug.nasl on still crashes the service but produces
only a single "broken pipe" error message. In both cases, a complete
system restart is necessary to get SunLink back up.

Here are the details:

Test Device:
Dell Inspiron 7500
RedHat Linux 6.2

Server:
Sun Ultra
Solaris 2.6
MQSeries v5.0
Sunlink 9.1

Tools:
nessus 1.0.5 with plugins current as of 12/12/00
nmap V. 2.54BETA5
tcpdump 3.4

SunLink Controller Window Error Messages:

Dec 13 12:52:10 XXX71890 bsd-gw[1769]: Error reading from connection:
Bad file number
Dec 13 12:52:10 XXX71890 rsh[1772]: connection from bad port
Dec 13 12:52:11 XXX71890 SunCPD: [Server SPARKY] XSVC000c : error on
socket write in dis_sock_write. Broken pipe
Dec 13 12:52:11 XXX71890 XSVC000c : error on socket write in
dis_sock_write. Broken pipe
Dec 13 12:52:11 XXX71890 inetd[1774]: execv /usr/openwin/bin/Xaserver:
No such file or directory
Dec 13 12:52:11 XXX71890 inetd[186]: /usr/openwin/bin/Xaserver:
HangupDec 13 12:52:30 XXX71890 last message repeated 118 times
Dec 13 12:52:30 XXX71890 rsh[1909]: connection from bad port
Dec 13 12:52:30 XXX71890 inetd[186]: /usr/openwin/bin/Xaserver: Hangup
Dec 13 12:52:33 XXX71890 last message repeated 16 times
Dec 13 12:52:33 XXX71890 bsd-gw[1928]: Invalid protocol request (71):
GGET / HTTP/1.0
Dec 13 12:52:33 XXX71890 inetd[186]: /usr/openwin/bin/Xaserver: Hangup
Dec 13 12:52:48 XXX71890 last message repeated 82 times
Dec 13 12:52:49 XXX71890 SunCPD: [System XXX71890] XSVC0011 : calloc
failure - unable to allocate memory in dis_sock_read
Dec 13 12:52:49 XXX71890 XSVC0011 : calloc failure - unable to allocate
memory in dis_sock_read
Dec 13 12:52:49 XXX71890 XSVC0011 : callolast message repeated 11 times
Dec 13 12:52:49 XXX71890 XSVC0011 : calloc failure - unable to allocate
memory in d
Dec 13 12:52:49 XXX71890 SunCPD: [System XXX71890] nable to allocate
memory in dis_sock_read
Dec 13 12:52:49 XXX71890 XSVC0011 : calloc failure - unable to allocate
memory in dis_sock_read
Dec 13 12:52:49 XXX71890 XSVC0011 : callolast message repeated 12 times
Dec 13 12:52:49 XXX71890 XSVC0011 : callo
Dec 13 12:52:49 XXX71890 SunCPD: [System XXX71890] is_sock_read
Dec 13 12:52:49 XXX71890 XSVC0011 : calloc failure - unable to allocate
memory in dis_sock_read
--More--(2%)


We have advised Sun of the problem but would like to hear from others
who might have some experience with it, has ideas regarding what might
be causing it, or possible solutions. Any feedback would be greatly
appreciated.

Thanks,
Exblue



---------------------------------
Do You Yahoo!?
Yahoo! Autos - Get free new car price quotes