Sun Solaris File System Management RBAC Profile Arbitrary Command Execution Vulnerability

Bugtraq ID:	19643
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 21 2006 12:00AM
Updated:	Aug 30 2006 06:03PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc
Not Vulnerable:

Sun Solaris File System Management RBAC Profile Arbitrary Command Execution Vulnerability

Solaris is prone to an arbitrary command-execution vulnerability.

A local attacker can exploit this issue to execute arbitrary commands with superuser privileges. Exploiting this issue allows attackers to completely compromise affected computers.

Sun Solaris File System Management RBAC Profile Arbitrary Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sun Solaris File System Management RBAC Profile Arbitrary Command Execution Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the references for more information.

Sun Solaris File System Management RBAC Profile Arbitrary Command Execution Vulnerability

References:

• Security Vulnerability May Allow Users With The File System Management RBAC Prof (Sun Microsystems)
  
• Solaris Homepage (Sun Microsystems)