Thanks for the response.  You are correct, it occurs when scanned locally.
I haven't sent the coredump to Sun support, since I'm running the free
downloaded version of Solaris 10, and it appears that Sun has switched to a
subscription model for support on their new OS (similar to Redhat).  I will
try patching and scanning again.

After this little exercise, and subsequent research which revealed that Sun
won't offer patches other than security fixes to Solaris 10 without a
subscription, I've come to the conclusion that Solaris 10 is not worth the
effort.  I'll keep my scanning nodes on Solaris 9 and try not to worry about
the instability of Solaris 10.

Cheers,

Luke

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of George A. Theall
Sent: Monday, April 18, 2005 10:50 AM
To: [email protected]
Subject: Re: Interesting Solaris 10 issue

On Mon, Apr 11, 2005 at 10:32:03AM -0400, Luke Youngblood
wrote:

> I recently installed Solaris 10 (the 03/05 GA release) on
> an Ultra 10 and decided to scan it with Nessus before
> hardening it just to see what type of holes it might find.
>  Apparently, an unpatched and non-hardened Solaris 10 box
> will crash hard when scanned by Nessus.  

When scanned _locally_, right?

> It has a kernel
> panic, and dumps core. not good.

Have you sent the coredump to Sun support for analysis?

> Does anyone have any ideas as to what might cause this?

It would be interesting to hear what happens once you fully
patch the system and try to scan it again.

>  I
> can't imagine the redhat plugin causing it to crash
> because it didn't run.  

No, it's not -- nessusd has decided already not to run the
plugin. And the panic doesn't occur until ~20 seconds after
that.

What I don't see in nessusd.messages is when
account_toor.nasl finished. This is identical to
account_glftpd.nasl (other than the specific account being
checked), which did finish, so I doubt the problem lies with
that particular plugin either; instead, it may be an
indication of the network (loopback?) interface failing
under stress.


George

--
[EMAIL PROTECTED]
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus

_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus

Reply via email to