Sun Grid Engine 'rsh' Bug Lets Local Users Obtain Root Privileges
|
|
SecurityTracker Alert ID: 1015835
|
|
SecurityTracker URL: http://securitytracker.com/id?1015835
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 28 2006
|
Impact: Root access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): Sun Grid Engine 5.3, N1 Grid Engine 6.0
|
Description: A vulnerability was reported in 'rsh' on Sun Grid Engine. A local user can obtain elevated privileges on the target system.
A local user can invoke 'rsh' to obtain root privileges on the target system.
|
Impact: A local user can obtain root privileges on the target system.
|
Solution: Sun has issued the following fixes.
SPARC Platform
* Sun Grid Engine 5.3 (32-bit Solaris) with patch 113136-06 or later
* Sun Grid Engine 5.3 (64-bit Solaris) with patch 113137-06 or later
* Sun Grid Engine 5.3 (32-bit Solaris) NON-Solaris
Package format with patch 113849-06 or later
* Sun Grid Engine 5.3 (64-bit Solaris) NON-Solaris Package format with patch 113850-06
or later
* Sun Grid Engine Enterprise Edition 5.3 (32-bit Solaris) with patch 113139-07 or later
* Sun Grid Engine Enterprise
Edition 5.3 (64-bit Solaris) with patch 113140-07 or later
* Sun Grid Engine Enterprise Edition 5.3 (32-bit Solaris) NON-Solaris
Package format with patch 113855-06 or later
* Sun Grid Engine Enterprise Edition 5.3 (64-bit Solaris) NON-Solaris Package
format with patch 113856-06 or later
* N1 Grid Engine 6.0 (32-bit Solaris) with patch 121956-01 or later
* N1 Grid Engine
6.0 (64-bit Solaris) with patch 121957-01 or later
* N1 Grid Engine 6.0 (32-bit Solaris) NON-Solaris Package format with patch
121960-01 or later
* N1 Grid Engine 6.0 (64-bit Solaris) NON-Solaris Package format with patch 121961-01 or later
x86 Platform
* Sun Grid Engine 5.3 with patch 113138-07 or later
* Sun Grid Engine 5.3 NON-Solaris Package format with patch 113851-06
or later
* Sun Grid Engine Enterprise Edition 5.3 with patch 116658-03 or later
* Sun Grid Engine Enterprise Edition 5.3
NON-Solaris Package format with patch 116659-03 or later
* N1 Grid Engine 6.0 with patch 121958-01 or later
* N1 Grid
Engine 6.0 NON-Solaris Package format with patch 121962-01 or later
* N1 Grid Engine 6.0 (x64) with patch 121959-01 or later
* N1 Grid Engine 6.0 (x64) NON-Solaris Package format with patch 121963-01 or later
Linux
* Sun Grid Engine 5.3 with
patch 113852-06 or later
* Sun Grid Engine Enterprise Edition 5.3 with patch 113900-05 or later
* Sun Grid Engine Enterprise
Edition 5.3 (x64) with patch 117293-02 or later
* N1 Grid Engine 6.0 with patch 121964-01 or later
* N1 Grid Engine 6.0
(x64) with patch 121965-01 or later
Windows
* N1 Grid Engine 6.0 with patch 121971-01 or later
HP-UX
* N1 Grid
Engine 6.0 with patch 121969-01 or later
AIX
* N1 Grid Engine 6.0 (for AIX 4.3)with patch 121966-01 or later
* N1
Grid Engine 6.0 (for AIX 5.1)with patch 121967-01 or later
MAC OS
* N1 Grid Engine 6.0 with patch 121968-01 or later
IRIX
* N1 Grid Engine 6.0 (for IRIX 6.5) with patch 121970-01 or later
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-1022
68-1
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-102268-1 (Links to External Site)
|
Cause: Not specified
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (OS X), UNIX (SGI/IRIX), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 28 Mar 2006 00:40:21 -0500
Subject: Security Vulnerability in Sun Grid Engine/N1 Grid Engine rsh(1) Binary
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102268-1
|
|
