Sun Solaris NFS 'netgroups' Security Bypass Vulnerability

Bugtraq ID:	26872
Class:	Access Validation Error
CVE:	CVE-2007-6413
Remote:	Yes
Local:	No
Published:	Dec 13 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10_sparc Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri CTX 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Multiservice Switch - MDM 0 Nortel Networks Media Processing Server
Not Vulnerable:

Sun Solaris NFS 'netgroups' Security Bypass Vulnerability

Sun Solaris is prone to a security-bypass vulnerability due to an unspecified error.

A successful attack will allow an unauthorized remote user to gain superuser access to shared NFS resources on the vulnerable system with 'netgroups' access configured.

This issue affects Sun Solaris 10 with the following kernel patches:

- kernel patches 120011-04 (and later) that are prior to 127111-05 on SPARC platforms
- kernel patches 120012-04 (and later) that are prior to 127954-03 on x86 platforms

Sun Solaris NFS 'netgroups' Security Bypass Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Solaris NFS 'netgroups' Security Bypass Vulnerability

Solution:
The vendor has released patches to address this issue. Please see the references for more information.


Sun Solaris 10_x86

• Sun Sun Patch ID 127954-03
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-127954-03-1

Sun Solaris NFS 'netgroups' Security Bypass Vulnerability

References:

• Sun Alert ID: 103162 - Solaris 10 Kernel Patches May Allow Privileged Remote Use (Sun Microsystems)
  
• Nortel Response to Sun Alert 103162 - Solaris 10 Kernel Patches May Allow Privil (Nortel Networks)