2892 : Solaris Xsun DGA Mode Local Privilege Escalation and DoS
Printer | http://osvdb.org/2892 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
10	625	over 8 years ago	over 4 years ago	0 times	75%

Timeline

Disclosure Date
2003-12-02

Description

Solaris systems running the Xsun(1) Solaris X11 server are vulnerable to unprivileged local users that may be able to overwrite or create arbitrary files on the system or crash the Xsun(1) server due to vulnerabilities in the Xsun(1) server and Direct Graphics Access (DGA) mode. Successful exploitation may lead to root privileges on the system.

Classification

Attack Type: Denial of Service
Impact: Loss of Availability

Solution

Sun Microsystems has made the following patches available based on platform and version:

SPARC Platform

Solaris 2.6 with patch 105633-64 or later
Solaris 7 with patch 108376-44 or later
Solaris 8 with patch 108652-72 or later
Solaris 9 with patch 112785-25 or later

x86 Platform

Solaris 2.6 with patch 106248-49 or later
Solaris 7 with patch 108377-39 or later
Solaris 8 with patch 108653-61 or later
Solaris 9 with patch 112786-15 or later

Products

Sun Microsystems, Inc.	Solaris	2.6
		7
		8
		9

References

Secunia Advisory ID: 10346
ISS X-Force ID: 13890
CVE ID: 2003-1058 (see also: NVD)
SCIP VulDB ID: 425
Vendor Specific Advisory URL: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57419

Credit

Unknown or Incomplete

CVSSv2 Score

CVSSv2 Base Score = 3.7
Source: nvd.nist.gov | Generated: 2005-05-24 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.