Note: This is an archival copy of Security Sun Alert 201221 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000909.1.
Article ID : 1000909.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2003-11-09
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Running Xsun Server in Direct Graphics Access (DGA) Mode May Allow Creation of Temporary Files Insecurely or Allow a "Denial of Service" Attack

Category
Security

Release Phase
Resolved

Product
Solaris 9 Operating System
Solaris 2.6 Operating System
Solaris 7 Operating System
Solaris 8 Operating System

Bug Id
4680913

Date of Resolved Release
02-DEC-2003

Impact

On Solaris systems which run the Xsun(1) Solaris X11 server, unprivileged local users may be able to overwrite or create any file on the system due to a security vulnerability involving Xsun(1) and Direct Graphics Access (DGA) mode. Xsun is normally started by "root" user from "dtlogin", and typically has full root privileges. This issue may also allow a local user to crash the Xsun process of any user of a DGA application, a type of "Denial-of-Service".


Contributing Factors

This issue can occur in the following releases:

SPARC Platform

  • Solaris 2.6 without patch 105633-64
  • Solaris 7 without patch 108376-44
  • Solaris 8 without patch 108652-72
  • Solaris 9 without patch 112785-25

x86 Platform

  • Solaris 2.6 without patch 106248-49
  • Solaris 7 without patch 108377-39
  • Solaris 8 without patch 108653-61
  • Solaris 9 without patch 112786-15

These vulnerabilities may be present during the use of any application that uses DGA - including Java applications and applications that use OpenGL (3D accelerated graphics - commonly used in CAD applications).


Symptoms

There are no predictable symptoms that would indicate the above described issue has been exploited.


Workaround

There is no workaround. Please see the "Resolution" section below.


Resolution

This issue is addressed in the following releases:

SPARC Platform

  • Solaris 2.6 with patch 105633-64 or later
  • Solaris 7 with patch 108376-44 or later
  • Solaris 8 with patch 108652-72 or later
  • Solaris 9 with patch 112785-25 or later

x86 Platform

  • Solaris 2.6 with patch 106248-49 or later
  • Solaris 7 with patch 108377-39 or later
  • Solaris 8 with patch 108653-61 or later
  • Solaris 9 with patch 112786-15 or later


Modification History

References
 108376-44

 108652-72

 112785-25

 106248-49

 108377-39

 108653-61

 112786-15

 105633-64



                                                                                                                                  


Attachments
This solution has no attachment