Sun Solaris ATOK12 Unspecified Insecure File/Directory Permissions Vulnerability

Bugtraq ID:	13732
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 03 2001 12:00AM
Updated:	Jun 03 2001 12:00AM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Sun SunOS 5.8 _x86 Sun SunOS 5.8 Sun Solaris 8_x86 Sun Solaris 8_sparc
Not Vulnerable:

Sun Solaris ATOK12 Unspecified Insecure File/Directory Permissions Vulnerability

Sun Solaris's ATOK12 is susceptible to an unspecified file/directory permissions vulnerability.

This vulnerability may allow local attackers to modify, or destroy data pertaining to the ATOK12 system. This may allow attackers to deny service to legitimate users. If the affected files or directories contain sensitive information, local attackers may possibly gain access to it.

Due to a lack of information, it is unknown at this time what other implications this vulnerability may expose.

Sun describes this issue as: "4361738 security problem with file/dir permissions"

Sun Solaris ATOK12 Unspecified Insecure File/Directory Permissions Vulnerability

An exploit is not required.

Sun Solaris ATOK12 Unspecified Insecure File/Directory Permissions Vulnerability

Solution:
Sun has released patches to address this issue:


Sun Solaris 8_x86

• Sun 110417-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-110417-01-1

Sun Solaris 8_sparc

• Sun 110416-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-110416-01-1

Sun SunOS 5.8

• Sun 110416-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-110416-01-1

Sun SunOS 5.8 _x86

• Sun 110417-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-110417-01-1

Sun Solaris ATOK12 Unspecified Insecure File/Directory Permissions Vulnerability

References:

• Solaris[tm] Product Line (Sun Microsystems)