Sun Microsystems Solaris Mail Reading Local Race Condition Vulnerability

Bugtraq ID:	6838
Class:	Race Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 11 2003 12:00AM
Updated:	Feb 11 2003 12:00AM
Credit:	Vulnerability announced by Sun Microsystems.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

Sun Microsystems Solaris Mail Reading Local Race Condition Vulnerability

It has been reported that the mail program distributed with Solaris is vulnerable to a race condition. Due to a problem with the handling of opening mail spool files, a local user may be able to launch an attack that permits the reading of another user's email.

Sun Microsystems Solaris Mail Reading Local Race Condition Vulnerability

Solution:
Sun has made fixes available:


Sun Solaris 2.6

• Sun 109266-05
  http://sunsolve.sun.com

Sun Solaris 7.0

• Sun 109253-07
  http://sunsolve.sun.com

Sun Solaris 8_x86

• Sun 111875-06
  http://sunsolve.sun.com

Sun Solaris 2.6_x86

• Sun 109267-05
  http://sunsolve.sun.com

Sun Solaris 8_sparc

• Sun 111874-06
  http://sunsolve.sun.com

Sun Solaris 9

• Sun 114133-01
  http://sunsolve.sun.com

Sun Solaris 9_x86

• Sun 114134-01
  http://sunsolve.sun.com

Sun Solaris 7.0_x86

• Sun 109254-07
  http://sunsolve.sun.com