Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability

Bugtraq ID:	37321
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Dec 10 2009 12:00AM
Updated:	Dec 15 2009 03:13PM
Credit:	Sun Microsystems
Vulnerable:	Sun Ray Server Software 4.1
Not Vulnerable:

Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability

Sun Ray Server Software is prone to a security-bypass vulnerability.

An attacker with physical access to an affected computer can exploit this issue to gain unauthorized access to an unlocked session. Successful exploits may lead to other attacks.

Sun Ray Server Software 4.1 running on Solaris is vulnerable.

Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability

An attacker with physical access to an affected computer can exploit this issue.

Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.


Sun Ray Server Software 4.1

• Sun 139548-03
  for SPARC
  http://sunsolve.sun.com/pdownload.do?target=139548-03&method=h


• Sun 139549-03
  for x86
  http://sunsolve.sun.com/pdownload.do?target=139549-03&method=h

Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability

References:

• Sun Ray Server Homepage (Sun Microsystems)
  
• #268228: Vulnerability in Sun Ray Server Software due to Logout Failure (Sun Microsystems)