Note: This is an archival copy of Security Sun Alert 200161 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000116.1.
Article ID : 1000116.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2010-01-24
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Access Control List (ACL) Permissions May Not be Consistently Set on New VERITAS File System (VxFS) Files

Category
Security

Release Phase
Resolved

Bug Id
4778806

Date of Resolved Release
27-JUN-2003

Impact

A local unprivileged user may be able to gain additional access privileges to VERITAS File System (VxFS) files due to incorrect permissions being set when Access Control Lists (ACLs) are being utilized. 



Contributing Factors



This issue can occur in the following releases:




SPARC Platform



    

  • 
VxFS 3.3.3 (for Solaris 2.5.1, 2.6, 7, and 8)

    • 

  • 
VxFS 3.4 (for Solaris 2.6) without patch 110433-08

    • 

  • 
VxFS 3.4 (for Solaris 7) without patch 110434-09

    • 

  • 
VxFS 3.4 (for Solaris 8) without patch 110435-08

    • 

  • 
VxFS 3.4 (for Solaris 9) without patch 113604-01

    • 

  • 
VxFS 3.5 (for Solaris 7) without patch 113205-05

    • 

  • 
VxFS 3.5 (for Solaris 8) without patch 113206-05

    • 

  • 
VxFS 3.5 (for Solaris 9) without patch 113207-05

    • 




Note: VxFS 3.5 (for Solaris 2.6) is not supported. Affected customers using VxFS 3.5 on Solaris 2.6 should contact VERITAS and reference VERITAS incident #113367.



Symptoms



The ACL permissions are not set consistently when new files are created. The result is that the permissions for some new files may be more open than intended.







Workaround



There is no workaround. Please see the "Resolution" section below.



Resolution



This issue is addressed in the following releases:




SPARC Platform



    

  • 
VxFS 3.4 (for Solaris 2.6) with patch 110433-08 or later

    • 

  • 
VxFS 3.4 (for Solaris 7) with patch 110434-09 or later

    • 

  • 
VxFS 3.4 (for Solaris 8) with patch 110435-08 or later

    • 

  • 
VxFS 3.4 (for Solaris 9) with patch 113604-01 or later

    • 

  • 
VxFS 3.5 (for Solaris 7) with patch 113205-05 or later

    • 

  • 
VxFS 3.5 (for Solaris 8) with patch 113206-05 or later

    • 

  • 
VxFS 3.5 (for Solaris 9) with patch 113207-05 or later

    • 




Note: VxFS 3.3.3 will require an upgrade.




Modification History



Product
Veritas File System 3.5 Software

References
 110433-08

 110434-09

 110435-08

 113604-01

 113205-05

 113206-05

 113207-05



                                                                                                      



Attachments
This solution has no attachment