Note: This is an archival copy of Security Sun Alert 231803 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019007.1.
Solaris 10 Operating System
Date of Resolved Release
Security Vulnerability in the Solaris 10 DTrace Dynamic Tracing Framework May Allow Unauthorized Kernel Level Tracing
1. ImpactA security vulnerability in the Solaris 10 DTrace (see dtrace(1M)) dynamic tracing framework may allow a local user or a non-global zone which has been granted either the PRIV_DTRACE_USER or the PRIV_DTRACE_PROC privilege (see privileges(5)) to be able to perform some kernel-level tracing. Such users may then be able to access sensitive information.
2. Contributing FactorsThis issue can occur in the following releases:
3. SymptomsThere are no predictable symptoms that would indicate the described issue has been exploited to view sensitive kernel data.
4. WorkaroundIf users have been granted any of the DTrace privileges, those privileges can be removed until the patches have been applied. The additional privileges may have been configured via policy.conf(4) or user_attr(4). If the privileges have been configured directly in the local "/etc/user_attr" file, they can be removed (as "root" user) with the usermod(1M) utility as in the following example:
# usermod -K limitpriv=all,!dtrace_user,!dtrace_proc userIf non-global zones have been granted any of these privileges, they can be removed with zonecfg(1M) as in the following example:
# zonecfg -z <zone name>In order for this change to take effect, reboot the zone after the zone configuration is changed.
Note: Privileges may also be assigned via an execution profile (see exec_attr(4)) or even to running processes using ppriv(1).
5. ResolutionThis issue is addressed in the following releases:
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
28-Apr-2008: Updated Resolution section to add link for Security Technical Instruction doc
This solution has no attachment