DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely).
Buffer Overflow Crash:
echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif
dmi_cmd -CI ../../../usr/home/btellier/my.mif
Sun Microsystems Solaris dmispd contains a flaw that may allow a local denial of service. The issue is triggered when dmi_cmd is used to add a file which has more than 1024 characters in the first line to the DMI database, and will result in loss of availability for the DMI service.
Currently, there are no known workarounds or upgrades to correct this issue. However, Sun Microsystems has released a patch to address this vulnerability.