Sun StorEdge Enterprise Storage Manager Lets Local ESMUsers Gain Root Access
|
|
SecurityTracker Alert ID: 1010557 |
|
SecurityTracker URL: http://securitytracker.com/id/1010557
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 21 2004
|
Impact:
Root access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.1
|
Description:
A vulnerability was reported in the Sun StorEdge Enterprise Storage Manager. A local user may be able to gain root access in certain cases.
Sun reported that when a non-root user has been assigned the "ESMUser" role on the management station, the user may be able to gain root access.
Sun notes that Enterprise Storage Manager (ESM) versions 1.2 and 2.0 are not affected.
|
Impact:
A local user with "ESMUser" privileges can gain root access.
|
Solution:
Sun has issued the following fix for Sun SPARC Platforms:
Sun StorEdge Enterprise Storage Manager 2.1 (for Solaris 8 and Solaris 9) with patch 117367-01 or later
|
Vendor URL: sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57581 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
UNIX (Solaris - SunOS)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 21 Jun 2004 10:47:28 -0400
Subject: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57581
|
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57581
57581 Systems With Enterprise Storage Manager 2.1 Installed May Allow an Unprivileged
Local User to Gain Root Acess 18 Jun 2004
Sun reported that a local user may be able to gain root access on systems with Enterprise
Storage Manager (ESM) 2.1 installed.
The vulnerability only occurs when a non-root user has been assigned the "ESMUser" role on
the management station, Sun said.
Sun notes that Enterprise Storage Manager (ESM) versions 1.2 and 2.0 are not affected.
Sun has issued the following fix:
SPARC Platform
* Sun StorEdge Enterprise Storage Manager 2.1 (for Solaris 8 and Solaris 9) with
patch 117367-01 or later
-----
* Sun Alert ID: 57581
* Synopsis: Systems With Enterprise Storage Manager 2.1 Installed May Allow an
Unprivileged Local User to Gain Root Access
* Category: Security
* Product: Sun StorEdge Enterprise Storage Manager (ESM)
* BugIDs: 5033990
* Avoidance: Workaround, Patch
* State: Resolved
* Date Released: 18-Jun-2004
* Date Closed: 18-Jun-2004
* Date Modified:
|
|
