Category
Security
Release Phase
Resolved
Bug Id
6510153
ProductSolaris 10 Operating System
OpenSolaris
Date of Resolved Release07-Aug-2008
Security Vulnerability in Solaris Trusted Extensions Labeled Networking may lead to remote unauthorized access to the Global Zone (zones(5)) of the System
1. Impact
If a Solaris Trusted Extensions system has a labeled zone which is in
the "installed" state, a security vulnerability in Solaris Trusted
Extensions labeled networking may allow remote unauthorized users from
another system (at the same label) to gain access to the global zone of
the affected system, if that user has access to a username and password
that is valid within the global zone. This is a Mandatory Access
Control (MAC) policy violation. The global zone in the Solaris Trusted
Extensions system is the administrative zone, which should only be
accessible to administrative roles (see rbac(5)).
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
- Solaris 10 without patch 125100-08
-
OpenSolaris based upon builds snv_39 through snv_67
x86 Platform
- Solaris 10 without patch 125101-08
-
OpenSolaris based upon builds snv_39 through snv_67
Notes:
- Solaris 8 and Solaris 9 are not impacted by this issue. Releases
prior to Solaris 10 11/06 do not include Solaris Trusted Extensions and
so are not vulnerable to this issue.
- This issue only impacts Solaris 10 and OpenSolaris systems which have
installed and configured Solaris Trusted Extensions and which have a
labeled zone which is in the "installed" state.
To determine if a system is configured with Trusted Extensions, the
following command can be run:
$ svcs /system/labeld
STATE STIME FMRI
online 07:08:09 svc:/system/labeld:default
If the state is disabled or if "/system/labeld" service is not listed,
then the system is not configured to use Trusted Extensions.
To determine if a labeled zone is in the "installed" state, the
following command can be run:
$ zoneadm list -cv
ID NAME STATUS PATH BRAND
0 global running / native
1 public running /zone/public native
2 internal running /zone/internal native
3 needtoknow running /zone/needtoknow native
- restricted installed /zone/restricted native
If the status of a zone is "installed", then the zone is in the
installed state.
3. Symptoms
There are no reliable symptoms that would indicate the described issue
has been exploited to gain unauthorized access to the global zone of
the system.
4. Workaround
There is no workaround for this issue. Please see the Resolution
section below.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
- Solaris 10 with patch 125100-08 or later
-
OpenSolaris based upon builds snv_68 or later
x86 Platform
- Solaris 10 with patch 125101-08 or later
-
OpenSolaris based upon builds snv_68 or later
For more information
on Security Sun Alerts, see 1009886.1.
This Sun Alert
notification is being provided to you on
an "AS IS"
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2008 Sun Microsystems,
Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.
References
125100-08
125101-08
AttachmentsThis solution has no attachment