Note: This is an archival copy of Security Sun Alert 240099 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019496.1.
Solaris 10 Operating System
Date of Resolved Release
Security Vulnerability in Solaris Trusted Extensions Labeled Networking may lead to remote unauthorized access to the Global Zone (zones(5)) of the System
If a Solaris Trusted Extensions system has a labeled zone which is in the "installed" state, a security vulnerability in Solaris Trusted Extensions labeled networking may allow remote unauthorized users from another system (at the same label) to gain access to the global zone of the affected system, if that user has access to a username and password that is valid within the global zone. This is a Mandatory Access Control (MAC) policy violation. The global zone in the Solaris Trusted Extensions system is the administrative zone, which should only be accessible to administrative roles (see rbac(5)).
2. Contributing Factors
This issue can occur in the following releases:
To determine if a system is configured with Trusted Extensions, the following command can be run:
$ svcs /system/labeld
If the state is disabled or if "/system/labeld" service is not listed, then the system is not configured to use Trusted Extensions.
To determine if a labeled zone is in the "installed" state, the following command can be run:
$ zoneadm list -cv
If the status of a zone is "installed", then the zone is in the installed state.
There are no reliable symptoms that would indicate the described issue has been exploited to gain unauthorized access to the global zone of the system.
There is no workaround for this issue. Please see the Resolution section below.
This issue is addressed in the following releases:
This solution has no attachment