Solaris power management Vulnerability
BID:160
Info
Solaris power management Vulnerability
| Bugtraq ID: | 160 |
| Class: | Environment Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 16 1998 12:00AM |
| Updated: | Jul 16 1998 12:00AM |
| Credit: | This vulnerability was posted to Bugtraq by Ralf Lehmann <[email protected]> on July 16, 1998. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 |
| Not Vulnerable: |
Sun Solaris 7.0_x86 Sun Solaris 7.0 |
Discussion
Solaris power management Vulnerability
A vulnerability exists in Sun's power management software under Solaris versions 2.4-2.6 (although only 2.6 as part of the main distribution). The sys-suspend program is initiated when a user runs the program, or presses the power key on a sun keyboard. This program moves the contents of memory to the disk, and powers down the system. As part of this shutdown procedure, it runs xlock to prevent a user from resuming the machine and accessing the logged in account.
The vulnerability that exists is due to the order in which sys-suspend performs its operations. As xlock is run by this program, it executes after the suspension begins. Upon a resume, there is a window of time during which any data typed at the keyboard is passed to whatever X application last had focus. If this was an xterm, arbitrary commands can be issued. In the even the user who was logged in was root, system security can be entirely subverted.
A vulnerability exists in Sun's power management software under Solaris versions 2.4-2.6 (although only 2.6 as part of the main distribution). The sys-suspend program is initiated when a user runs the program, or presses the power key on a sun keyboard. This program moves the contents of memory to the disk, and powers down the system. As part of this shutdown procedure, it runs xlock to prevent a user from resuming the machine and accessing the logged in account.
The vulnerability that exists is due to the order in which sys-suspend performs its operations. As xlock is run by this program, it executes after the suspension begins. Upon a resume, there is a window of time during which any data typed at the keyboard is passed to whatever X application last had focus. If this was an xterm, arbitrary commands can be issued. In the even the user who was logged in was root, system security can be entirely subverted.
Exploit / POC
Solaris power management Vulnerability
1: press the power key on Sun keyboard, and suspend the machine. 2: Upon pressing the power button again, the machine will indicate it is resuming, and the screen will go blank. Any data typed between this notification and the resumption of the machine (and xlock) will be passed to the application which last had focus.
1: press the power key on Sun keyboard, and suspend the machine. 2: Upon pressing the power button again, the machine will indicate it is resuming, and the screen will go blank. Any data typed between this notification and the resumption of the machine (and xlock) will be passed to the application which last had focus.
Solution / Fix
Solaris power management Vulnerability
Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com
Disabling sys-suspend, or running xlock prior to suspend will also eliminate this vulnerability.
Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com
Disabling sys-suspend, or running xlock prior to suspend will also eliminate this vulnerability.