Solaris chkey Vulnerability

Bugtraq ID:	207
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	May 19 1997 12:00AM
Updated:	May 19 1997 12:00AM
Credit:	This bug was originally posted to the Bugtraq mailing list by Adam Morrison ([email protected]) on Mon, 19 May 1997.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4
Not Vulnerable:	Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6

Solaris chkey Vulnerability

The chkey program is used to change a users secure RPC Diffie-Hellman public key and secret key pair. A buffer overflow condition has been found in the chkey program. Since chkey has setuid root permissions, an unauthorized user may be able to gain root access.

Solaris chkey Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 2.4_x86

• Sun 104974-01
  x86
  

Sun Solaris 2.5

• Sun 104971-01
  sparc
  

Sun Solaris 2.4

• Sun 104973-01
  sparc
  

Sun Solaris 2.5_x86

• Sun 104972-01
  x86
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-104972-01-1

Sun Solaris 2.5.1 _x86

• Sun 104969-01
  x86
  

Sun Solaris 2.5.1

• Sun 104968-01
  sparc
  

Solaris chkey Vulnerability

References:

• Australian CERT (AUSCERT)
  
• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)