Admintool mode 0777 Vulnerability

Bugtraq ID:	290
Class:	Configuration Error
CVE:
Remote:	No
Local:	Yes
Published:	May 07 1998 12:00AM
Updated:	May 07 1998 12:00AM
Credit:	This problem was posted to the Bugtraq mailing list by Paul B. Henson <[email protected]> Thu, 7 May 1998.
Vulnerable:	Sun Solaris 2.6 HW3/98
Not Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 Sun Solaris 2.2 Sun Solaris 2.1 Sun Solaris 2.0

Admintool mode 0777 Vulnerability

Solaris 2.6 HW3/98 shipped the /usr/bin/admintool binary with permissions 0777 (world writeable). This permission set would allow intruders toreplace the binary with a trojaned copy to gain root privilages.

Admintool mode 0777 Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Admintool mode 0777 Vulnerability

Solution:
Change the permissions on /usr/bin/admintool to 04555 which is the proper mode per the initial 2.6 release of Solaris.

Admintool mode 0777 Vulnerability

References:

• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)