__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Sun's XSun Program Buffer Overflow Vulnerability
[Sun Alert ID: 55420]
June 20, 2003 19:00 GMT Number N-108
______________________________________________________________________________
PROBLEM: The Xsun program is the Graphical User Interface subsystem
installed by default on all Sun Solaris systems. A buffer
overflow vulnerability in the dbm_open(ndbm(3C) and dbm(3UCB))
and dbminit(3UCB) database functions has been found.
PLATFORM: Solaris v2.6, 7, 8, and 9
DAMAGE: A local unprivileged user may be able to gain unauthorized root
privileges.
SOLUTION: Apply appropriate vendor patches.
______________________________________________________________________________
VULNERABILITY The risk is MEDIUM. A local user could execute arbitrary code
ASSESSMENT: with root privileges.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-108.shtml
ORIGINAL BULLETIN:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=
fsalert%2F55420&zone_32=category%3Asecurity
______________________________________________________________________________
[***** Start Sun Alert ID: 55420 *****]
Sun(sm) Alert Notification
Sun Alert ID: 55420
Synopsis: A Buffer Overflow Vulnerability in the dbm_open(ndbm(3C) and
dbm(3UCB)) and dbminit(3UCB) Database Functions May Allow Unauthorized
Root Privileges
Category: Security
Product: Solaris
BugIDs: 4661997, 4668699
Avoidance: Patch
State: Resolved
Date Released: 19-Jun-2003
Date Closed: 19-Jun-2003
Date Modified:
1. Impact
A local unprivileged user may be able to gain unauthorized root privileges due
to a buffer overflow vulnerability in the database function routines dbm_open(3C)
and dbminit(3UCB). The dbm_open(3C) database function is present in the C
library libc(3LIB) and is used in the Solaris privileged program Xsun(1).
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
Solaris 2.6 without patches 105210-47, 105377-06 and 105401-43
Solaris 7 without patches 106541-22, 106942-26 and 106949-03
Solaris 8 without patches 108827-24, 108993-16 and 109152-02
Solaris 9 without patches 112874-01, 112922-02, 113319-10, 114569-02
and 114571-01
x86 Platform
Solaris 2.6 without patches 105211-49 and 105402-43
Solaris 7 without patches 106542-22 and 106943-26
Solaris 8 without patches 108828-25, 108994-16 and 114617-01
Solaris 9 without patches 113719-03, 114570-01 and 114715-01
3. Symptoms
There are no predictable symptoms that would show the described issue has
been exploited to gain unauthorized root access to a system.
Solution Summary
4. Relief/Workaround
There is no workaround. Please see the "Resolution" section below.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
Solaris 2.6 with patches 105210-47, 105377-06 and 105401-43 or later for
each listed patch
Solaris 7 with patches 106541-22, 106942-26 and 106949-03 or later for
each listed patch
Solaris 8 with patches 108827-24, 108993-16 and 109152-02 or later for
each listed patch
Solaris 9 with patches 112874-01, 112922-02, 113319-10, 114569-02 and
114571-01 or later for each listed patch
x86 Platform
Solaris 2.6 with patches 105211-49 and 105402-43 or later for
each listed patch
Solaris 7 with patches 106542-22 and 106943-26 or later for
each listed patch
Solaris 8 with patches 108828-25, 108994-16 and 114617-01 or later for
each listed patch
Solaris 9 with patches 113719-03, 114570-01 and 114715-01 or later for
each listed patch
This Sun Alert notification is being provided to you on an "AS IS" basis.
This Sun Alert notification may contain information provided by third parties.
The issues described in this Sun Alert notification may or may not impact
your system(s). Sun makes no representations, warranties, or guarantees as
to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR
IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY
DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN
NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR
CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE
INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun
proprietary and confidential information. It is being provided to you
pursuant to the provisions of your agreement to purchase services from Sun,
or, if you do not have such an agreement, the Sun.com Terms of Use. This
Sun Alert notification may only be used for the purposes contemplated by
these agreements.
Copyright 2000-2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
CA 95054 U.S.A. All rights reserved.
[***** End Sun Alert ID: 55420 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of Sun Microsystems for the
information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
N-098: Microsoft Cumulative Patch for Internet Information Service (IIS)
N-099: Apache 2.0.46 Release Fixes Security Vulnerabilities
N-100: Microsoft Windows Media Services ISAPI Extenstion Flaw
N-101: Microsoft Cumulative Patch for Internet Explorer (IE)
N-102: Hewlett-Packard Potential Security Vulnerabilities in CDE
N-103: Sun ONE Application Server May Disclose JavaServer Pages (JSP) Source
N-104: Red Hat Updated KDE packages
N-105: Sun "/usr/lib/utmp_update" Command Buffer Overflow Vulnerability
N-106: SGI Websetup/Webmin Security Vulnerability
N-107: PDF readers/viewers Malicious Hyperlinks Vulnerability
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
