Note: This is an archival copy of Security Sun Alert 201153 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000872.1.
Article ID : 1000872.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2005-11-30
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in the Xsun(1) and Xprt(1) Commands



Category
Security

Release Phase
Resolved

Product
Solaris 9 Operating System
Solaris 10 Operating System
Solaris 7 Operating System
Solaris 8 Operating System

Bug Id
6265045

Date of Workaround Release
26-SEP-2005

Date of Resolved Release
01-DEC-2005

Impact

A security vulnerability which affects the Xsun(1) and Xprt(1) commands may allow a a local unprivileged user the ability to execute arbitrary code with the privileges of either the Xsun(1) or Xprt(1) command.

Sun acknowledges, with thanks, Eric Sheridan of Towson University for bringing this issue to our attention.


Contributing Factors

This issue can occur in the following releases:

SPARC Platform

  • Solaris 7 without patch 108376-46
  • Solaris 8 without patch 108652-93
  • Solaris 9 without patch 112785-50
  • Solaris 10 without patch 119059-05

x86 Platform

  • Solaris 7 without patch 108377-41
  • Solaris 8 without patch 108653-82
  • Solaris 9 without patch 112786-39
  • Solaris 10 without patch 119060-05

Symptoms

There are no predictable symptoms that would indicate the described issue has been exploited.


Workaround

To work around the described issue, remove the setuid(2) and/or setgid(2) bit from Xsun(1) and Xprt(1).

Note: Performing the above procedure will disable the following:

1. The ability to run Xsun on Solaris x86.

2. Power management and Interactive Process Priority control on Solaris SPARC.

3. Xsun(1) and Xprt(1) ability to open Unix domain sockets and named pipe transports in the protected "/tmp/.X11-*" directories.

Note: These features will still be available if Xsun(1) is started via display managers such as dtlogin(1) or gdm(1), however, the system would still be vulnerable to this issue.


Resolution

This issue is addressed in the following releases:

SPARC Platform

  • Solaris 7 with patch 108376-46 or later
  • Solaris 8 with patch 108652-93 or later
  • Solaris 9 with patch 112785-50 or later
  • Solaris 10 with patch 119059-05 or later

x86 Platform

  • Solaris 7 with patch 108377-41 or later
  • Solaris 8 with patch 108653-82 or later
  • Solaris 9 with patch 112786-39 or later
  • Solaris 10 with patch 119060-05 or later


Modification History
Date: 30-NOV-2005
  • Updated Contributing Factors and Relief/Workaround sections

Date: 01-DEC-2005
  • State: Resolved
  • Updated Contributing Factors and Relief/Workaround sections


References

108652-93
119059-05
108653-82
119060-05
112785-50
112786-39
108376-46
108377-41




Attachments
This solution has no attachment