Note: This is an archival copy of Security Sun Alert 201482 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1001109.1.
Article ID : 1001109.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2003-07-28
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in the Solaris Runtime Linker ld.so.1(1)

Category
Security

Release Phase
Resolved

Product
Solaris 9 Operating System
Solaris 2.6 Operating System
Solaris 7 Operating System
Solaris 8 Operating System

Bug Id
4872634

Date of Resolved Release
29-JUL-2003

Impact

An unprivileged local user may be able to gain unauthorized root privileges due to a buffer overflow in the runtime linker ld.so.1(1).

Sun acknowledges with thanks, Jouko Pynnönen (jouko@iki.fi) for bringing this issue to our attention and iDEFENSE Inc. (www.idefense.com) for coordinating the release of this issue.

This issue is described in iDEFENSE Advisory located at: http://www.idefense.com/application/poi/display?id=1&type=vulnerabilities.


Contributing Factors

This issue can occur in the following releases:

SPARC Platform

  • Solaris 2.6 with patch 107733-10 and without patch 107733-11
  • Solaris 7 with patches 106950-14 through 106950-22 and without patch 106950-23
  • Solaris 8 with patches 109147-07 through 109147-24 and without patch 109147-25
  • Solaris 9 without patch 112963-09

x86 Platform

  • Solaris 2.6 with patch 107734-10 and without patch 107734-11
  • Solaris 7 with patches 106951-14 through 106951-22 and without patch 106951-23
  • Solaris 8 with patches 109148-07 through 109148-24 and without patch 109148-25
  • Solaris 9 without patch 113986-05

Symptoms

There are no reliable symptoms that would show the described issue has been exploited. 



Workaround



There is no workaround. Please see the "Resolution" section below.







Resolution



This issue is addressed in the following releases:




SPARC Platform



    

  • 
Solaris 2.6 with patch 107733-11 or later

    • 

  • 
Solaris 7 with patch 106950-23 or later

    • 

  • 
Solaris 8 with patch 109147-25 or later

    • 

  • 
Solaris 9 with patch 112963-09 or later

    • 




x86 Platform



    

  • 
Solaris 2.6 with patch 107734-11 or later

    • 

  • 
Solaris 7 with patch 106951-23 or later

    • 

  • 
Solaris 8 with patch 109148-25 or later

    • 

  • 
Solaris 9 with patch 113986-05 or later

    • 




Modification History

Date: 20-JAN-2004


    

  • 
Modified URL listed in Impact

    • 








References
 107733-11

 107734-11

 106950-23

 106951-23

 109147-25

 109148-25

 112963-09

 113986-05



                                                                                                              


Attachments
This solution has no attachment