__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Sun Solaris dtsession Security Vulnerability
[Sun(sm) Alert Notification 53288]
April 4, 2003 19:00 GMT Number N-072
______________________________________________________________________________
PROBLEM: A heap buffer overflow exists in dtsession.
PLATFORM: * Sun Solaris 2.5.1
* Sun Solaris 2.6
* Sun Solaris 7
* Sun Solaris 8
* Sun Solaris 9
DAMAGE: A valid length check has not been implemented when handling the
HOME variable. By carefully crafting data, a local user could
cause a heap buffer overflow and execute arbitrary code with
root privileges.
SOLUTION: Apply patch or workaround as stated in Sun's Alert
notification.
______________________________________________________________________________
VULNERABILITY The risk is MEDIUM. The dtsession(1)CDE Session Manager runs
ASSESSMENT: with root privileges. In order to exploit this vulnerability,
an attacker would need a legitimate account and permission on
the target system.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-072.shtml
ORIGINAL BULLETIN:
http://www.sunsolve.sun.com/pub-cgi/
retrieve.pl?doc=fsalert%2F52388&zone_32=category%3Asecurity
______________________________________________________________________________
[***** Start Sun(sm) Alert Notification 53288 *****]
Sun(sm) Alert Notification
Sun Alert ID: 52388
Synopsis: Security Vulnerability with /usr/dt/bin/dtsession
Category: Security
Product: Solaris, CDE
BugIDs: 4788212
Avoidance: Workaround
State: Committed
Date Released: 03-Apr-2003
Date Closed:
Date Modified:
1. Impact
A local user may be able to execute arbitrary code or commands with the
privileges of the dtsession(1) CDE Session Manager. The dtsession(1) CDE
Session Manager runs with root privileges.
This issue is described in NSFOCUS Security Bulletin SA2003-03 available
from http://www.nsfocus.com/english/homepage/sa2003-03.htm .
Sun acknowledges with thanks, NSFOCUS Information Technology, for bringing
this issue to our attention.
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
Solaris 2.6
Solaris 7
Solaris 8
Solaris 9 without patch 114497-01
x86 Platform
Solaris 2.6
Solaris 7
Solaris 8
Solaris 9 without patch 114498-01
Note: Solaris 2.5.1 will not be evaluated regarding the potential impact of
the issue described in this Sun Alert document.
3. Symptoms
There are no predictable symptoms that show this issue has been exploited.
Solution Summary Top
4. Relief/Workaround
To work around the described issue, turn off the set-user-ID ("setuid") bit
for dtsession as root, shown below:
# chmod 0555 /usr/dt/bin/dtsession
This will cause dtsession to not be able to unlock the screen by the list
of keyholders (including root), see dtsession(1) for further information.
Furthermore, this will cause locally defined users in /etc/passwd to not be
able to unlock the screen. NIS/NIS+ users will be able to continue to
unlock the screen.
Thus caution should be used for local users. For these users once the
set-user-ID bit has been turned off they should use xlock(1) and turn off
automatic locking by dtsession. Auto locking can be turned off by using
dtstyle manager's ("dtstyle") screen option. Once the screen option popup
appears, turn off auto locking by selecting the "off" choice for the Screen
Saver and Screen Lock options. Then in order to lock the screen the user
will need to use "xlock" from the command line of a terminal window.
Note: Dates for patch availability for Solaris 2.6, 7, and 8 are not
yet determined.
This Sun Alert will be updated when more information or patches become
available.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
Solaris 9 with patch 114497-01 or later
x86 Platform
Solaris 9 with patch 114498-01 or later
A final resolution is pending completion.
This Sun Alert notification is being provided to you on an "AS IS" basis.
This Sun Alert notification may contain information provided by third parties.
The issues described in this Sun Alert notification may or may not impact your
system(s). Sun makes no representations, warranties, or guarantees as to the
information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING
THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun
Alert notification contains Sun proprietary and confidential information.
It is being provided to you pursuant to the provisions of your agreement to
purchase services from Sun, or, if you do not have such an agreement, the
Sun.com Terms of Use. This Sun Alert notification may only be used for the
purposes contemplated by these agreements.
Copyright 2000-2003 Sun Microsystems, Inc., 4150 Network Circle,
Santa Clara, CA 95054 U.S.A. All rights reserved.
[***** End Sun(sm) Alert Notification 53288 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of Sun Microsystems, Inc. and
NSFOCUS Information Technology, CO., Ltd. for the information contained in
this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
N-062: MIT krb5 Buffer overrun and underrun in Principal Name Handling
N-063: Microsoft Windows Script Engine Vulnerability
N-064: Sun Buffer Overflow in Web Connector Module of Application Server
N-065: Multiple Vulnerabilities in Lotus Notes and Domino
N-066: RealPlayer PNG Deflate Heap Corruption Vulnerability
N-067: Sendmail MTA Buffer Overflow Vulnerability
N-068: Sun Solaris Buffer Overflow in lpq(1B) Command
N-069: Sun Solaris newtask(1) Command Vulnerability
N-070: Sun Solaris at(1) Command Vulnerability
N-071: Red Hat Eye of GNOME (EOG) Packages Fix Format String Vulnerability
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
