Solaris PAM & unix_scheme Vulnerability

Bugtraq ID:	201
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 25 1997 12:00AM
Updated:	Feb 25 1997 12:00AM
Credit:	This was originally posted to the BugTraq mailing list by Cristian SCHIPOR ([email protected]) on Tue, 25 Feb 1997.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3
Not Vulnerable:	Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6

Solaris PAM & unix_scheme Vulnerability

There is a buffer overflow condition on arguments in Pluggable Authentication Modules (PAM) and unix_scheme (5.4 and 5.3). Therefore, an unauthorized user could exploit this vulnerability via the passwd program to gain root access. Under SunOS 5.5.1, 5.5.1_x86, 5.5, 5.5_x86, yppasswd and nispasswd are hard links to the passwd program and therefore are also vulnerable. Under SunOS 5.4 and 5.3, passwd, yppasswd, and nispasswd are separate programs but they dynamically link unix_scheme and are affected.

Solaris PAM & unix_scheme Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 2.4_x86

• Sun 101946-43
  x86
  

Sun Solaris 2.5

• Sun 103178-03
  sparc
  

Sun Solaris 2.3

• Sun 101318-87
  sparc
  

Sun Solaris 2.5_x86

• Sun 103179-03
  x86
  

Sun Solaris 2.4

• Sun 101945-49
  sparc
  

Sun Solaris 2.5.1 _x86

• Sun 104434-02
  x86
  

Sun Solaris 2.5.1

• Sun 104433-03
  sparc
  

Solaris PAM & unix_scheme Vulnerability

References:

• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)