SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (UNIX)  >   Solaris Vendors:   Sun
Sun Solaris Basic Security Module 'ad' or 'as' Auditing Lets Local Users Crash the System
SecurityTracker Alert ID:  1010572
SecurityTracker URL:  http://securitytracker.com/id/1010572
CVE Reference:   CVE-2004-0654   (Links to External Site)
Updated:  Jul 14 2004
Original Entry Date:  Jun 23 2004
Impact:   Denial of service via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Solaris 7, 8, and 9
Description:   A denial of service vulnerability was reported in Sun Solaris with the Basic Security Module (BSM) in a certain configuration. A local user can cause denial of service conditions.

Sun reported that a local user on a Solaris system with Basic Security Module (BSM) enabled can cause a system panic. The system is reportedly vulnerable if the BSM has been configured to audit the Administrative audit class "ad" or the System-Wide Administration audit class "as".

AUE_MODADDMAJ does not properly check user arguments, the vendor said.

Impact:   A local user can cause a system panic.
Solution:   Sun has issued the following fixes:

SPARC Platform

* Solaris 7 with patch 106541-33 or later
* Solaris 8 with patch 109007-18 or later
* Solaris 9 with patch 114332-12 or later

x86 Platform

* Solaris 7 with patch 106542-33 or later
* Solaris 8 with patch 109008-18 or later
* Solaris 9 with patch 116558-01 or later

Vendor URL:  sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57497 (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57497


http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57497

57497 	  	Security Vulnerability in Solaris Systems With Basic Security Module (BSM) 
Configured to Audit the "ad" or "as" Audit Class 	  	22 Jun 2004

Sun reported that a local user on a Solaris system with Basic Security Module (BSM) 
enabled can cause a kernel panic.  The system is reportedly vulnerable if the BSM has been 
configured to audit the Administrative audit class "ad" or the System-Wide Administration 
audit class "as".

Sun has issued the following fixes:

SPARC Platform

     * Solaris 7 with patch 106541-33 or later
     * Solaris 8 with patch 109007-18 or later
     * Solaris 9 with patch 114332-12 or later

x86 Platform

     * Solaris 7 with patch 106542-33 or later
     * Solaris 8 with patch 109008-18 or later
     * Solaris 9 with patch 116558-01 or later

----

     * Sun Alert ID: 57497
     * Synopsis: Security Vulnerability in Solaris Systems With Basic Security Module 
(BSM) Configured to Audit the "ad" or "as" Audit Class
     * Category: Security
     * Product: Solaris
     * BugIDs: 4857394
     * Avoidance: Patch
     * State: Resolved
     * Date Released: 22-Jun-2004
     * Date Closed: 22-Jun-2004
     * Date Modified:


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC