Note: This is an archival copy of Security Sun Alert 261849 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1020621.1.
Solaris 10 Operating System
Date of Resolved Release
A security vulnerability in the Solaris iSCSI Management commands (iscsiadm(1M) and iscsitadm(1M)) may allow privilege escalation:
A security vulnerability in the Solaris iSCSI management commands (iscsiadm(1M) and iscsitadm(1M)) may allow a local user who has been assigned an RBAC execution profile which specifies additional privileges for the iscsiadm(1M) or iscsitadm(1M) commands, such as the "File System Management" profile, to execute arbitrary commands with the privileges specified in the RBAC profile.
2. Contributing Factors
This issue can occur in the following releases:
Note 2: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. To determine the base build of OpenSolaris, the following command can be used:
$ uname -v
Note 3: This issue only affects systems where a local user has been granted an execution profile allowing them to run the iscsiadm(1M) or iscsitadm(1M) commands with elevated privileges such as the "File System Management" profile.
The assignment of profiles to users is configured in the user_attr(4) database. The exec_attr(4) database specifies the execution attributes associated with profiles. Thus, if a system is configured to only reference local files for the user_attr(4) and exec_attr(4) databases then users who have been assigned a profile containing iscsiadm(1M) or iscsitadm(1M) can be determined as follows:
$ egrep 'iscsiadm|iscsitadm' /etc/security/exec_attrSystems which are configured via nsswitch.conf(4) to use attribute sources other than local files for the user_attr(4) and exec_attr(4) databases will need to use the relevant commands to perform the equivalent search. See the documentation for the relevant attribute source (for example, ldap(1), ypfiles(4) or nis+(1)) for details.
There are no predictable symptoms that would indicate the described issue has occurred.
To work around this issue until patches can be applied, remove references to the iscsiadm(1M) and iscsitadm(1M) commands from the exec_attr(4) database. This will result in users who have been assigned the relevant execution profile(s) to no longer be granted privileged access to the iscsiadm(1M) and iscsitadm(1M) commands.
This issue is addressed in the following releases:
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment