Sun Solaris Human Interface Device Local Denial of Service Vulnerability

Bugtraq ID:	25814
Class:	Unknown
CVE:	CVE-2007-5118
Remote:	No
Local:	Yes
Published:	Sep 25 2007 12:00AM
Updated:	May 07 2015 05:35PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc Avaya CMS Server 13.0 Avaya CMS Server 12.0 Avaya CMS Server 14.0 Avaya CMS Server 13.1
Not Vulnerable:

Sun Solaris Human Interface Device Local Denial of Service Vulnerability

Sun Solaris is prone to a local denial-of-service vulnerability.

This issue stems from an unspecified error in the Human Interface Device (HID) Class Driver. Local attackers may exploit this issue to trigger kernel panics or system hangs, denying service to legitimate users.

These versions are affected:

Solaris 8, 9, and 10 SPARC
Solaris 9 and 10 x86

Sun Solaris Human Interface Device Local Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Solaris Human Interface Device Local Denial of Service Vulnerability

Solution:
Sun has released an advisory and fixes to address this issue. Please see the references for more information.


Sun Solaris 8_sparc

• Sun Solaris 8 SPARC patch 109896-35
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -109896-35-1

Sun Solaris 9_x86

• Sun Solaris 9 x86 patch 115554-24
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -115554-24-1

Sun Solaris Human Interface Device Local Denial of Service Vulnerability

References:

• Sun Solaris Home Page (Sun Microsystems)
  
• ASA-2007-410 - Security Vulnerability in the Human Interface Device (HID) Class (Avaya)
  
• Sun Alert ID: 102883 -- Security Vulnerability in the Human Interface Device (HI (Sun Microsystems)