Product
Solaris 9 Operating System
Solaris 7 Operating System
Solaris 8 Operating System

Bug Id
4705947, 4705948

Date of Resolved Release
26-FEB-2004

Impact

The "/usr/lib/print/conv_fix" command is invoked by the conv_lpd(1M) script and contains a security vulnerability. If the conv_lpd(1M) script is executed as the "root" user, it may be possible for unprivileged local users to exploit this vulnerability to overwrite or create any file on the system. This could lead to unauthorized elevated privileges or allow a Denial of Service (DoS) against the system.

Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• Solaris 7 without patch 107115-14
• Solaris 8 without patch 109320-09
• Solaris 9 without patch 113329-05

x86 Platform

• Solaris 7 without patch 107116-14
• Solaris 8 without patch 109321-09
• Solaris 9 without patch 114980-05

Symptoms

There are no reliable symptoms that would indicate the described issue has been exploited, as it depends on which file is overwritten or created.

Workaround

To work around the described issue, run conv_lpd(1M) as a non-root user.

Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 7 with patch 107115-14 or later
• Solaris 8 with patch 109320-09 or later
• Solaris 9 with patch 113329-05 or later

x86 Platform

• Solaris 7 with patch 107116-14 or later
• Solaris 8 with patch 109321-09 or later
• Solaris 9 with patch 114980-05 or later

Modification History

References

107115-14
109320-09
113329-05
107116-14
109321-09
114980-05




Attachments

This solution has no attachment