Executive brief
A vulnerability in the removable media mounting service of SunOS 5.7 allows users with physical access to a machine to gain full administrative (root) control. By inserting a floppy disk or CD-ROM containing a specially crafted program and triggering the mount process, a standard user can bypass security restrictions that should prevent unauthorized privilege elevation. This poses a significant risk to workstations or servers where unauthorized individuals have physical access to disk drives.
Technical details
The rmmount utility in SunOS 5.7 contains a logic error where it fails to enforce the 'nosuid' mount option for removable media (floppies and CD-ROMs), despite documentation stating otherwise. An attacker with local account access and physical access to the hardware can insert media containing a setuid-root binary and execute 'volcheck' to mount the filesystem. Because the 'nosuid' flag is missing, the setuid bit is honored, allowing the attacker to execute the binary and escalate privileges to root. This behavior differs from previous SunOS versions. A workaround involves manually adding 'mount' entries with the '-o nosuid' flag to /etc/rmmount.conf.
Affected products
- Sun Microsystems SunOS 5.7
Timeline
- 1995-05-10: disclosed: Initial public disclosure via Bugtraq (Note: NVD date 1995 may be an outlier vs 1999 CVE ID)
- 1999-05-10: other: Detailed Bugtraq report by Jonas Stahre regarding Solaris 7/SunOS 5.7 behavior