Sun Ray UTXConfig Local Arbitrary File Overwrite Vulnerability

Bugtraq ID:	19394
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 07 2006 12:00AM
Updated:	Jan 04 2007 06:27PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Sun Ray Server Software 2.0 Sun Ray Server Software 3.1 Sun Ray Server Software 3.0
Not Vulnerable:

Sun Ray UTXConfig Local Arbitrary File Overwrite Vulnerability

The utxconfig utility is prone to a vulnerability that may allow local attackers to create or overwrite arbitrary files.

This issue is due to a failure in the application to properly sanitize user-supplied input.

A local attacker can exploit this issue to create or overwrite arbitrary files with superuser privileges.

Sun Ray UTXConfig Local Arbitrary File Overwrite Vulnerability

An attacker uses the affected utility to exploit this issue.

Sun Ray UTXConfig Local Arbitrary File Overwrite Vulnerability

Solution:
The vendor has released an advisory and patches to address this issue.


Sun Ray Server Software 3.1

• Sun 120879-01
  SPARC for Solaris 8, 9 and 10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120879-01-1


• Sun 120880-01
  x86 for Solaris 8, 9 and 10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120880-01-1


• Sun 120881-01
  Linux platform
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120881-01-1

Sun Ray Server Software 3.0

• Sun 118979-02
  Solaris 8 and 9 on SPARC
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -118979-02-1


• Sun 119836-02
  Linux Platform
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119836-02-1

Sun Ray UTXConfig Local Arbitrary File Overwrite Vulnerability

References:

• Security Vulnerability in the Sun Ray Utility utxconfig(1) (Sun)
  
• Sun Ray Software Product Page (Sun)