Note: This is an archival copy of Security Sun Alert 200101 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000085.1.
Solaris 9 Operating System
Solaris 8 Operating System
Date of Resolved Release
A security vulnerability in the kcms_calibrate(1) command may allow local unprivileged users to execute arbitrary commands with root privileges.
Sun acknowledges, with thanks, Cees-Bart Breunesse of the University of Nijmegen for bringing this issue to our attention.
This issue can occur in the following releases:
Note: Solaris 10 is not affected by this issue since the Kodak Color Management System (KCMS) no longer ships in Solaris 10 and later.
There are no predictable symptoms that would indicate the described issue has been exploited to execute arbitrary code on a system.
To prevent this issue from occurring until the patches listed in section 5 can be applied, the set-user-ID bit can be removed from the kcms_calibrate(1) binary using the following command as the root (uid 0) user:
# chmod u-s /usr/openwin/bin/kcms_calibrate
Alternatively if the Kodak Color Management System (KCMS) utilities are not being used the following packages can be removed from the system using pkgrm(1M):
Core KCMS packages:
application SUNWkcslx KCMS Runtime Library (64-bit) application SUNWkcspf KCMS Optional Profiles application SUNWkcspg KCMS Programmers Environment application SUNWkcspx KCMS Programmers Environment (64-bit) system SUNWkcsrl KCMS Runtime Library Support system SUNWkcsrr KCMS Runtime Profiles application SUNWkcsrt KCMS Runtime Environment application SUNWkcsrx KCMS Runtime Environment (64-bit)
Translated KCMS packages:
ALE SUNWckcsr Simplified Chinese (EUC) KCMS Runtime Environment application SUNWdkcsr German KCMS Runtime Environment application SUNWekcsr Spanish KCMS Runtime Environment application SUNWfkcsr French KCMS Runtime Environment ALE SUNWhkcsr Traditional Chinese (EUC) KCMS Runtime Environment application SUNWikcsr Italian KCMS Runtime Environment application SUNWjkcsr Japanese KCMS Runtime Environment ALE SUNWkkcsr Korean (EUC) KCMS Runtime Environment application SUNWskcsr Swedish KCMS Runtime Environment
The following command uses pkgrm(1) as the root user to remove all of the above packages:
# pkgrm SUNWkcslx SUNWkcspf SUNWkcspg SUNWkcspx SUNWkcsrl SUNWkcsrr \ SUNWkcsrt SUNWkcsrx SUNWckcsr SUNWdkcsr SUNWekcsr SUNWfkcsr SUNWhkcsr \ SUNWikcsr SUNWjkcsr SUNWkkcsr SUNWskcsr
This issue is addressed in the following releases:
This solution has no attachment