Sun Solaris IP Tunnel Param Local Code Execution Vulnerability

Bugtraq ID:	32904
Class:	Unknown
CVE:	CVE-2008-5689
Remote:	No
Local:	Yes
Published:	Dec 17 2008 12:00AM
Updated:	Jan 10 2011 08:32PM
Credit:	Tobias Klein
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10_sparc Sun OpenSolaris build snv_68 Sun OpenSolaris build snv_67 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_59 Sun OpenSolaris build snv_39 Sun OpenSolaris build snv_36 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0
Not Vulnerable:	Sun OpenSolaris build snv_77

Sun Solaris IP Tunnel Param Local Code Execution Vulnerability

Sun Solaris is prone to a local code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of the kernel on x86 systems. Successful exploits may completely compromise the vulnerable system.

On all architectures, attackers can exploit this issue to create a denial-of-service condition.

This issue affects the following on both x86 and SPARC platforms:

Solaris 10
OpenSolaris based on builds snv_01 through snv_76

Sun Solaris IP Tunnel Param Local Code Execution Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/32904.c

Sun Solaris IP Tunnel Param Local Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.

Sun Solaris IP Tunnel Param Local Code Execution Vulnerability

References:

• Sun Solaris Homepage (Sun Microsystems)
  
• [TKADV2008-015] Sun Solaris SIOCGTUNPARAM IOCTL Kernel NULL pointer dereference (Tobias Klein )
  
• ASA-2008-520 - Security Vulnerability in Solaris IP Tunnel Parameter Processing (Avaya)
  
• Security Vulnerability in Solaris IP Tunnel Parameter Processing May Lead to a S (Sun)