Note: This is an archival copy of Security Sun Alert 262088 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1020636.1.
Solaris 8 Operating System
Solaris 9 Operating System
Solaris 10 Operating System
Date of Resolved Release
Security Vulnerability in the Solaris auditconfig(3M) Command May Allow Users With an Associated RBAC Profile to Gain Elevated Privileges
A security vulnerability in the Solaris auditconfig(1M) command may allow a local user who has been assigned an RBAC execution profile which specifies additional privileges for auditconfig(1M) such as the "Audit Control" profile, to execute arbitrary commands with the privileges specified in the RBAC profile.
2. Contributing Factors
This issue can occur in the following releases:
1. Solaris 8 entered EOSL Phase 2 on 1 April 2009. Entitlement to patches developed on or after 1 April 2009 requires the purchase of the Solaris 8 Vintage Patch Service. See note in section 5 for more details.
2. This issue only affects systems which have Solaris Auditing (see bsmconv(1M)) enabled. To determine if a system has Solaris Auditing enabled, the grep(1) command can be used to search the '/etc/system' file for a reference to the c2audit kernel module as in the following example:
$ grep c2audit /etc/system3. This issue only affects systems where a local user has been granted an execution profile allowing them to run the auditconfig(1M) command with elevated privileges, such as the "Audit Control" profile.
The assignment of profiles to users is configured in the user_attr(4) database. The exec_attr(4) database specifies the execution attributes associated with profiles. Thus, if a system is configured to only reference local files for the user_attr(4) and exec_attr(4) databases, then users who have been assigned a profile containing auditconfig can be determined as follows:
$ grep auditconfig /etc/security/exec_attr
$ grep 'Audit Control' /etc/user_attrSystems which are configured via nsswitch.conf(4) to use attribute sources other than local files for the user_attr(4) and exec_attr(4) databases will need to use the relevant commands to perform the equivalent search. See the documentation for the relevant attribute source (for example, ldap(1), ypfiles(4) or nis+(1)) for details.
There are no predictable symptoms that would indicate this issue has been exploited to execute arbitrary commands with elevated privileges.
To work around this issue until patches can be applied, remove references to the auditconfig(1M) command from the exec_attr(4) database. This will result in users who have been assigned the relevant execution profile(s) to no longer be granted privileged access to the auditconfig command.
For example, if the system is configured to only reference local files for the exec_attr(4) database, a '#' symbol can be inserted at the beginning of lines in the "/etc/security/exec_attr" file which reference the 'auditconfig' command:
$ grep auditconfig /etc/security/exec_attr5. Resolution
This issue is addressed in the following releases:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment