SUBJECT: Vulnerability in Solaris 2.3 "automountd".
SUMMARY: Sun Microsystems has released a patch which will fix a vulnerability that exists in Solaris 2.3 automountd.
BACKGROUND: Patch 101329-15 fixes a bug in the Solaris 2.3 version of automountd which allows a user with an unprivileged account on a 2.3 system to gain root access. The automountd fix is bundled into the Solaris 2.3 jumbo NIS+ patch, the most current version of which is 101329-15. This bug is not found in any other SunOS version, including Solaris x86. The fix has been integrated into the upcoming Solaris 2.4 release. Sun patches can be obtained from Local Sun answer centers worldwide, SunSolve Online, and via anonymous ftp from the ftp.uu.net /systems/sun/sun-dist and ftp.eu.net ~ftp/sun/fixes directories.
IMPACT: Unauthorized users can obtain root access.
RECOMMENDED SOLUTION: Obtain and install the 101329-15 patch on all affected Solaris 2.3 systems. The following is checksum information for the patch:
File BSD SVR4
Name Checksum Checksum
- --------------- --------- ----------
101329-15.tar.Z 55492 843 46189 1685
MD5
Digital Signature
--------------------------------
19AA042484727A5DE9CB21199858071A
The checksums shown above are from the BSD-based checksum (on 4.1.x, /bin/sum; on Solaris 2.x, /usr/ucb/sum) and from the SVR4 version on Solaris 2.x (/usr/bin/sum).
ASSIST is an element of the Defense Information Systems Agency (DISA), Center for Information Systems Security (CISS), that provides service to the entire DoD community. If you are a constituent of the DoD and have any questions about ASSIST or computer security issues, contact ASSIST using one of the methods listed below. If your organization/institution is non-DoD, contact your Forum of Incident Response and Security Teams (FIRST) representative. You can obtain a list of FIRST member organizations and their constituencies by sending email to docserver@first.org with an empty "subject" line and a message body containing the line "send first-contacts".
ASSIST INFORMATION RESOURCES: If you would like to be included in the distribution list for these bulletins, send your Milnet (Internet) e-mail address to assist-request@assist.ims.disa.mil. Back issues of ASSIST bulletins, and other security related information, are available from the ASSIST BBS at 703-756-7993/ 1154 DSN 289, and through anonymous FTP from assist.ims.disa.mil (IP address 137.130.234.30). Note: assist.ims.disa.mil will only accept anonymous FTP connections from Milnet addresses that are registered with the NIC or DNS.
ASSIST contact information:
PHONE: 703-756-7974, DSN 289, duty hours are 06:00 to 22:30 EST Monday through Friday. During off duty hours, weekends, and holidays, ASSIST can be reached via pager at 800-SKY-PAGE (800-759-7243) PIN 2133937. Your page will be answered within 30 minutes, however if a quicker response is required, prefix your phone number with "999".
ELECTRONIC MAIL: Send to assist@assist.ims.disa.mil. ASSIST BBS: Leave a message for the "sysop".
Privacy Enhanced Mail (PEM): ASSIST uses PEM, a public key encryption tool, to digitally sign all bulletins that are distributed through e-mail. The section of seemingly random characters between the "BEGIN PRIVACY-ENHANCED MESSAGE" and "BEGIN ASSIST BULLETIN" contains machine-readable digital signature information generated by PEM, not corrupted data. PEM
software for UNIX systems is available from Trusted Information Systems (TIS) at no cost, and can be obtained via anonymous FTP from ftp.tis.com (IP 192.94.214.100). Note: The TIS software is just one of several implementations of PEM currently available and additional versions are likely to be offered from other sources in the near future.
Reference herein to any specific commercial products, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by ASSIST. The views and opinions of authors expressed herein shall not be used for adverstising or product endorsement purposes.