Note: This is an archival copy of Security Sun Alert 201231 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000918.1.
Date of Resolved Release
A local or remote unprivileged user may be able to gain unauthorized root privileges due to a buffer overflow vulnerability in the "pamverifier" program. The "pamverifier" program is part of the "Sun Management Center (SunMC) Change Manager" web application.
This issue can occur in the following releases:
To determine if "SunMC Change Manager" is installed on your system, run the following command:
# pkginfo | grep SUNWic system SUNWicam SunMC Change Manager Agent Component system SUNWicapp Change Manager Web Console Application system SUNWicaudit SunMC Change Manager Basic Audit Reporting Tool system SUNWiccli SunMC Change Manager CLI Commands system SUNWicclifw SunMC Change Manager CLI Framework system SUNWicsvc SunMC Change Manager Server Component
The console that SunMC Change Manager uses is started and stopped by the "/usr/sadm/bin/smcwebserver" script. This script starts the underlying web server as user "noaccess", and then calls the "pamverifier" program to assist (using "setuid root").
To determine the version of the SunMC Change Manager package on your system that contains "pamverifier", run the following command:
# pkgparam SUNWmcon VERSION
To determine the current patch levels of SunMC Change Manager, run the following command:
# pkgparam SUNWmcon PATCHLIST
There are no symptoms to indicate that the overflow has been successfully exploited to gain unauthorized root access on a host.
To work around the described issue, restrict access to the directory in which the "pamverifier" binary resides. This directory must be owned by the "noaccess" user and by the "other" group. This will make the program ("pamverifier) only accessible by the SunMC Change Manager. Run the the following commands to change the ownership and permissions of the directory:
# chown noaccess /usr/sadm/lib/webconsole/bin # chgrp other /usr/sadm/lib/webconsole/bin # chmod 500 /usr/sadm/lib/webconsole/bin
This issue is addressed in the following releases:
Sun Management Center Change Manager 1.0
This solution has no attachment