Executive brief
DIT TransferPro, a software package used for accessing removable media on Solaris systems, incorrectly configures system device drivers with insecure permissions. This allows any local user on the system to read from or write directly to hardware disks, potentially leading to permanent data loss or system failure. An attacker or even an accidental command from a non-privileged user could overwrite critical disk sectors, including the disk label and operating system files.
Technical details
The DIT TransferPro installation process creates device nodes for the 'ff' device driver (e.g., /dev/rff*) with 0666 (world-readable/writable) permissions instead of the secure 0640 standard. This vulnerability stems from improper permission assignment during the driver's setup on Solaris systems. Because the 'ff' driver can interact with standard hard disks in addition to removable media, a local unprivileged user can perform raw I/O operations on system disks. This can be exploited to bypass filesystem protections, overwrite disk labels, or corrupt data across any disk target reachable by the driver. The issue was originally identified on Solaris 2.6.
Affected products
- DIT TransferPro Solaris 2.6 and possibly others
Timeline
- 1998-01-05: disclosed: Initial discovery and report on Bugtraq
- 1998-01-05: advisory: NVD publication date