Note: This is an archival copy of Security Sun Alert 201221 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000909.1.
Solaris 9 Operating System
Solaris 2.6 Operating System
Solaris 7 Operating System
Solaris 8 Operating System
Date of Resolved Release
On Solaris systems which run the Xsun(1) Solaris X11 server, unprivileged local users may be able to overwrite or create any file on the system due to a security vulnerability involving Xsun(1) and Direct Graphics Access (DGA) mode. Xsun is normally started by "root" user from "dtlogin", and typically has full root privileges. This issue may also allow a local user to crash the Xsun process of any user of a DGA application, a type of "Denial-of-Service".
This issue can occur in the following releases:
These vulnerabilities may be present during the use of any application that uses DGA - including Java applications and applications that use OpenGL (3D accelerated graphics - commonly used in CAD applications).
There are no predictable symptoms that would indicate the above described issue has been exploited.
There is no workaround. Please see the "Resolution" section below.
This issue is addressed in the following releases:
This solution has no attachment