Sun Solaris DTrace Dynamic Tracing Framework Information Disclosure Vulnerability

Bugtraq ID:	27942
Class:	Input Validation Error
CVE:	CVE-2008-0938
Remote:	No
Local:	Yes
Published:	Feb 18 2008 12:00AM
Updated:	Feb 29 2008 09:52PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0
Not Vulnerable:

Sun Solaris DTrace Dynamic Tracing Framework Information Disclosure Vulnerability

Sun Solaris is prone to an information-disclosure vulnerability that affects the dynamic tracing framework because it fails to properly validate access before allowing users to perform certain actions.

Attackers can exploit this issue to obtain potentially sensitive information that may help in further attacks.

The issue affects Solaris 10 for SPARC and x86 platforms.

Sun Solaris DTrace Dynamic Tracing Framework Information Disclosure Vulnerability

An attacker can exploit this issues using readily available commands.

Sun Solaris DTrace Dynamic Tracing Framework Information Disclosure Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the references for more information.

Sun Solaris DTrace Dynamic Tracing Framework Information Disclosure Vulnerability

References:

• Sun Solaris Homepage (Sun Microsystems)
  
• ASA-2008-097 Security Vulnerability in the Solaris 10 DTrace Dynamic Tracing Fra (Avaya)
  
• Solution 231803: Security Vulnerability in the Solaris 10 DTrace Dynamic Tr (Sun Microsystems)