Solaris Solstice AdminSuite Vulnerabilities
BID:208
Info
Solaris Solstice AdminSuite Vulnerabilities
| Bugtraq ID: | 208 |
| Class: | Race Condition Error |
| CVE: |
CVE-1999-1424 CVE-1999-1425 CVE-1999-1426 CVE-1999-1427 CVE-1999-1428 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 10 1997 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was originally released by Sun Microsystems as Sun Security Bulletin 00145 on November 10, 1997. |
| Vulnerable: |
Sun Solstice AdminSuite 2.2 _x86 Sun Solstice AdminSuite 2.2 Sun Solstice AdminSuite 2.1 _x86 Sun Solstice AdminSuite 2.1 |
| Not Vulnerable: | |
Discussion
Solaris Solstice AdminSuite Vulnerabilities
Several vulnerabilities have been discovered in Solstice AdminSuite 2.1. These include:
1. AdminSuite 2.1 uses excessive permissions when adding new users to the NIS+ passwd table. This may allow unauthorized users to change the password table information to obtain root access.
2. AdminSuite 2.1 incorrectly changes the permissions on the source file used to build the NIS (YP) passwd map. This may allow unauthorized users to edit the /etc/passwd file and gain root access.
3. AdminSuite 2.1 creates temporary files in an insecure manner when updating a NIS (YP) database. This may allow unauthorized users to over write arbitrary files on the system, including the NIS (YP) map source file.
4. AdminSuite 2.1 and 2.2 create lock files in an insecure manner that may allow an unauthorized user to gain root access.
5. AdminSuite 2.1 and 2.2 Database Manager's save option is setgid bin for non-privileged users. This may allow an unauthorized user to gain root access.
Several vulnerabilities have been discovered in Solstice AdminSuite 2.1. These include:
1. AdminSuite 2.1 uses excessive permissions when adding new users to the NIS+ passwd table. This may allow unauthorized users to change the password table information to obtain root access.
2. AdminSuite 2.1 incorrectly changes the permissions on the source file used to build the NIS (YP) passwd map. This may allow unauthorized users to edit the /etc/passwd file and gain root access.
3. AdminSuite 2.1 creates temporary files in an insecure manner when updating a NIS (YP) database. This may allow unauthorized users to over write arbitrary files on the system, including the NIS (YP) map source file.
4. AdminSuite 2.1 and 2.2 create lock files in an insecure manner that may allow an unauthorized user to gain root access.
5. AdminSuite 2.1 and 2.2 Database Manager's save option is setgid bin for non-privileged users. This may allow an unauthorized user to gain root access.
Exploit / POC
Solaris Solstice AdminSuite Vulnerabilities
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Solaris Solstice AdminSuite Vulnerabilities
Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com
Sun Solstice AdminSuite 2.1 _x86
Sun Solstice AdminSuite 2.1
Sun Solstice AdminSuite 2.2
Sun Solstice AdminSuite 2.2 _x86
Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com
Sun Solstice AdminSuite 2.1 _x86
-
Sun 103236-08
x86
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103236-08-1
Sun Solstice AdminSuite 2.1
-
Sun 103235-08
sparc
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103235-08-1
Sun Solstice AdminSuite 2.2
-
Sun 103502-04
sparc
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103502-04-1
Sun Solstice AdminSuite 2.2 _x86
-
Sun 103503-03
x86
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103503-03-1
References
Solaris Solstice AdminSuite Vulnerabilities
References:
References:
- Sun Patch Access Page (Sun Microsystems)
- Sun Patches List (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)