Sun Solaris SAdmin Client Credentials Remote Administrative Access Vulnerability

Bugtraq ID:	8615
Class:	Design Error
CVE:	CVE-2003-0722
Remote:	Yes
Local:	No
Published:	Sep 16 2003 12:00AM
Updated:	Nov 15 2007 12:39AM
Credit:	Discovery credited to Mark Zielinski.
Vulnerable:	Sun Trusted Solaris 8.0 x86 Sun Trusted Solaris 8.0 Sun Trusted Solaris 7.0 x86 Sun Trusted Solaris 7.0 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

Sun Solaris SAdmin Client Credentials Remote Administrative Access Vulnerability

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Exploit code has been published.

An exploit (solaris_sadmind_exec.pm) has been released as part of the MetaSploit Framework 2.0.

• /data/vulnerabilities/exploits/rootdown.pl
• /data/vulnerabilities/exploits/solaris_sadmind_exec.pm

Sun Solaris SAdmin Client Credentials Remote Administrative Access Vulnerability

Solution:
Sun has released an advisory regarding this issue and has supplied specific instructions on securing a vulnerable system until a fix is released. See the referenced advisory for details.


Sun Solaris 7.0

• Sun 116456-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116456&rev=01

Sun Solaris 8_x86

• Sun 116442-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116442&rev=01

Sun Solaris 8_sparc

• Sun 116455-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116455&rev=01

Sun Solaris 9

• Sun 116453-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116453&rev=01

Sun Solaris 7.0_x86

• Sun 116457-02
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116457&rev=02

Sun Solaris 9_x86

• Sun 116454-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116454&rev=01

Sun Solaris SAdmin Client Credentials Remote Administrative Access Vulnerability

References:

• Remote Root Exploitation of Default Solaris sadmind Setting (iDefense)
  
• Sun Alert ID: 56740 (Sun Microsystems)
  
• Solaris SADMIND Exploitation (H D Moore )