Executive brief
A security vulnerability in older Sun Solaris operating systems could allow a local user to take full control of the server. The issue stems from improper file permissions on a system file used to track user logins. If this file is incorrectly configured to be writable by standard users, an attacker can manipulate system data to gain administrative (root) privileges, potentially leading to a total compromise of the system and its data.
Technical details
The vulnerability is a local privilege escalation resulting from insecure file permissions on the 'utmp' file in SunOS and Solaris. The utmp file maintains a record of currently logged-in users; if this file is globally writable or writable by non-privileged users, an attacker can modify its contents to exploit system utilities that rely on utmp data. By injecting malicious entries or manipulating existing ones, a local attacker can bypass security controls to execute commands with root privileges. This issue is primarily a configuration-based vulnerability (CWE-276) where the operating system fails to enforce strict access control on sensitive state files.
Affected products
- Sun Microsystems Solaris 1.1.1a and earlier
- Sun Microsystems SunOS
Timeline
- 1994-03-21: disclosed: Initial publication date