P-315: Security Vulnerability in the Xsun(1) and Xprt(1) Commands

Sun(sm) Alert Notification

Sun Alert ID: 101800
Synopsis: Security Vulnerability in the Xsun(1) and Xprt(1) Commands
Category: Security
Product: Solaris 9 Operating System, Solaris 10 Operating System, Solaris 7 Operating System, Solaris 8 Operating System
BugIDs: 6265045
Avoidance: Patch, Workaround
State: Workaround
Date Released: 26-Sep-2005
Date Closed:
Date Modified: 30-Nov-2005

1. Impact

A security vulnerability which affects the Xsun(1) and Xprt(1) commands may allow a a local unprivileged user the ability to execute arbitrary code with the privileges of either the Xsun(1) or Xprt(1) command.

Sun acknowledges, with thanks, Eric Sheridan of Towson University for bringing this issue to our attention.

2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

Solaris 7 without patch 108376-46
Solaris 8 without patch 108652-93
Solaris 9 without patch 112785-50
Solaris 10 without patch 119059-05

x86 Platform

Solaris 7
Solaris 8 without patch 108653-82
Solaris 9 without patch 112786-39
Solaris 10 without patch 119060-05

3. Symptoms

There are no predictable symptoms that would indicate the described issue has been exploited.

Solution Summary

Top

4. Relief/Workaround

To work around the described issue, remove the setuid(2) and/or setgid(2) bit from Xsun(1) and Xprt(1).

Note: Performing the above procedure will disable the following:

1. The ability to run Xsun on Solaris x86.

2. Power management and Interactive Process Priority control on Solaris SPARC.

3. Xsun(1) and Xprt(1) ability to open Unix domain sockets and named pipe transports in the protected "/tmp/.X11-*" directories.

Note: These features will still be available if Xsun(1) is started via display managers such as dtlogin(1) or gdm(1), however, the system would still be vulnerable to this issue.

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

Solaris 7 with patch 108376-46 or later
Solaris 8 with patch 108652-93 or later
Solaris 9 with patch 112785-50 or later
Solaris 10 with patch 119059-05 or later

x86 Platform

Solaris 8 with patch 108653-82 or later
Solaris 9 with patch 112786-39 or later
Solaris 10 with patch 119060-05 or later

A final resolution is pending completion.

Change History

30-Nov-2005:

Updated Contributing Factors and Relief/Workaround sections

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.


PROBLEM:	There is a security vulnerability which affects the Xsun(1) and Xprt(1) commands.
PLATFORM:	Solaris 7, 8, 9, 10 Operating Systems
DAMAGE:	May allow a local unprivileged user the ability to execute arbitrary code with the privileges of either the Xsun(1) and Xprt(1) command.
SOLUTION:	Upgrade to the appropriate version.

VULNERABILITY ASSESSMENT:	The risk is MEDIUM. May allow a local unprivileged user the ability to execute arbitrary code with the privileges of either the Xsun(1) and Xprt(1) command.

LINKS:
CIAC BULLETIN:	http://www.ciac.org/ciac/bulletins/p-315.shtml
ORIGINAL BULLETIN:	Sun Alert ID: 101800
	http://www.sunsolve.sun.com/search/document.do?assetkey=1-26-101800-1&searchclause=%22category:security%22%20%22availability,%20security%22%20category:security

Document Audience:	PUBLIC
Document ID:	101800
Title:	Security Vulnerability in the Xsun(1) and Xprt(1) Commands
Copyright Notice:	Copyright © 2005 Sun Microsystems, Inc. All Rights Reserved
Update Date:	Wed Nov 30 00:00:00 MST 2005

INFORMATION BULLETIN