Sun Solaris Serial Console Keystroke Interception Vulnerability

Bugtraq ID:	5161
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 04 2002 12:00AM
Updated:	Jul 04 2002 12:00AM
Credit:	Vulnerability announced by Sun Microsystems.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

Sun Solaris Serial Console Keystroke Interception Vulnerability

Solaris is the freely available Unix operating system distributed by Sun Microsystems.

Under some circumstances, it may be possible for users to gain access to information entered via a serial console. Solaris does not sufficiently secure data coming from the serial console. As a result, a local user may be able to monitor keystrokes send via the serial console.

Sun Solaris Serial Console Keystroke Interception Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sun Solaris Serial Console Keystroke Interception Vulnerability

Solution:
Fixes available.


Sun Solaris 7.0_x86

• Sun 106542-20
  http://sunsolve.sun.com

Sun Solaris 2.6

• Sun 105181-32
  http://sunsolve.sun.com

Sun Solaris 7.0

• Sun 106541-21
  http://sunsolve.sun.com

Sun Solaris 2.6_x86

• Sun 105182-32
  http://sunsolve.sun.com

Sun Solaris 2.5.1 _x86

• Sun 103641-40
  http://sunsolve.sun.com

Sun Solaris 2.5.1

• Sun 103640-40
  http://sunsolve.sun.com

Sun Solaris Serial Console Keystroke Interception Vulnerability

References:

• 45502 (Sun Microsystems)