Note: This is an archival copy of Security Sun Alert 200101 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000085.1.
Article ID : 1000085.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2007-02-07
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in the kcms_calibrate(1) Command

Category
Security

Release Phase
Resolved

Product
Solaris 9 Operating System
Solaris 8 Operating System

Bug Id
6272418

Date of Resolved Release
22-JAN-2007

Impact

A security vulnerability in the kcms_calibrate(1) command may allow local unprivileged users to execute arbitrary commands with root privileges.

Sun acknowledges, with thanks, Cees-Bart Breunesse of the University of Nijmegen for bringing this issue to our attention.


Contributing Factors

This issue can occur in the following releases:

SPARC Platform

  • Solaris 8 without patch 111400-04
  • Solaris 9 without patch 114636-04

x86 Platform

  • Solaris 8 without patch 111401-04
  • Solaris 9 without patch 114637-04

Note: Solaris 10 is not affected by this issue since the Kodak Color Management System (KCMS) no longer ships in Solaris 10 and later.


Symptoms

There are no predictable symptoms that would indicate the described issue has been exploited to execute arbitrary code on a system.


Workaround

To prevent this issue from occurring until the patches listed in section 5 can be applied, the set-user-ID bit can be removed from the kcms_calibrate(1) binary using the following command as the root (uid 0) user:

    # chmod u-s /usr/openwin/bin/kcms_calibrate

Alternatively if the Kodak Color Management System (KCMS) utilities are not being used the following packages can be removed from the system using pkgrm(1M):

Core KCMS packages:

    application SUNWkcslx   KCMS Runtime Library (64-bit)
    application SUNWkcspf   KCMS Optional Profiles
    application SUNWkcspg   KCMS Programmers Environment
    application SUNWkcspx   KCMS Programmers Environment (64-bit)
    system      SUNWkcsrl   KCMS Runtime Library Support
    system      SUNWkcsrr   KCMS Runtime Profiles
    application SUNWkcsrt   KCMS Runtime Environment
    application SUNWkcsrx   KCMS Runtime Environment (64-bit)

Translated KCMS packages:

    ALE         SUNWckcsr   Simplified Chinese (EUC) KCMS Runtime Environment
    application SUNWdkcsr   German KCMS Runtime Environment
    application SUNWekcsr   Spanish KCMS Runtime Environment
    application SUNWfkcsr   French KCMS Runtime Environment
    ALE         SUNWhkcsr   Traditional Chinese (EUC) KCMS Runtime Environment
    application SUNWikcsr   Italian KCMS Runtime Environment
    application SUNWjkcsr   Japanese KCMS Runtime Environment
    ALE         SUNWkkcsr   Korean (EUC) KCMS Runtime Environment
    application SUNWskcsr   Swedish KCMS Runtime Environment

The following command uses pkgrm(1) as the root user to remove all of the above packages:

    # pkgrm SUNWkcslx SUNWkcspf SUNWkcspg SUNWkcspx SUNWkcsrl SUNWkcsrr \
    SUNWkcsrt SUNWkcsrx SUNWckcsr SUNWdkcsr SUNWekcsr SUNWfkcsr SUNWhkcsr \
    SUNWikcsr SUNWjkcsr SUNWkkcsr SUNWskcsr

 


Resolution

This issue is addressed in the following releases:

SPARC Platform

  • Solaris 8 with patch 111400-04 or later
  • Solaris 9 with patch 114636-04 or later

x86 Platform

  • Solaris 8 with patch 111401-04 or later
  • Solaris 9 with patch 114637-04 or later


References

111400-04
111401-04
114636-04
114637-04




Attachments
This solution has no attachment