Vulnerability Note VU#901582

Sun Solaris vulnerable to DoS when the Basic Security Module (BSM) is configured to perform auditing of specific classes

Overview

There is a vulnerability in Sun Solaris that could allow local users to cause a denial of service when the Basic Security Module (BSM) is configured to perform auditing of specific audit classes.

I. Description

Sun Microsystems describes the Basic Security Module (BSM) as a "security auditing subsystem and a device allocation mechanism that provides the required object reuse characteristics for removable or assignable devices." There is a vulnerability in Sun Solaris systems with BSM enabled that could allow local users to cause a system panic.

According to the Sun Security Alert:

Local unprivileged users may be able to panic

Solaris systems

with Basic Security Module (BSM) enabled causing a Denial of Service (DoS). This issue can only occur on systems where BSM has been configured to audit the Administrative audit class "ad" or the System-Wide Administration audit class "as".

II. Impact

A local unprivileged user could cause a denial-of-service condition.

III. Solution

Sun has issued an advisory which addresses this issue. For more information on patches available for your system, please refer to Sun Security Alert: 57497.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Sun Microsystems Inc.	Vulnerable	28-Jun-2004

References

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57497
http://secunia.com/advisories/11930/
http://www.securitytracker.com/alerts/2004/Jun/1010572.html
http://www.securityfocus.com/bid/10594

Credit

This vulnerability was reported by Sun Microsystems Inc.

This document was written by Damon Morda.

Other Information

Date Public:	2004-06-22
Date First Published:	2004-06-28
Date Last Updated:	2004-06-28
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	3.46
Document Revision:	7

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader