|
Brought to you by:
Suppliers of:
|
|
|
| |
| A vulnerability in Solaris exists which permits a local non-privileged user to insert a user supplied kernel module. Once a kernel module is successfully integrated into the kernel, it effectively gives the malicious user root permissions on the system. |
| |
Credit:
The information has been provided by Dave Aitel of Immunity Inc..
The original article can be found at: http://www.immunitysec.com/downloads/solaris_kernel_vfs.sxw.pdf
|
| |
Vulnerable Systems:
* Solaris versions 2.6 through 10
The loading of a user-supplied module by a non-privileged user is possible due to a directory traversal bug in the vfs_getvfssw() function within the kernel. There are two system calls which can be used in order to trigger this vulnerability, namely mount() and sysfs().
Patch Availability:
Sun has supplied a patch which mitigates the vulnerability. It can be found at http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57479&zone_32=category%3Asecurity.
|
|
|
|
|
