An insufficient validation security vulnerability in OpenSSL may allow a malformed signature to be treated as a good signature rather than as an error. This issue affects the signature checks on DSA keys used with SSL/TLS. This vulnerability may allow a remote user who is in control of a rogue server or who can use a "man-in-the-middle attack" to masquerade as a valid, legitimate server using malformed SSL certificates.

Sun acknowledges with thanks, Google Security Team for bringing this issue to our attention.

This issue is also referenced in the following document:

• CVE-2008-5077 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077

Permalink | Comments [0]

There are three security vulnerabilities in the Tomcat JSP/Servlet container that affect Tomcat 5.5 bundled in Solaris 9 and Solaris 10.

The first two security vulnerabilities are Cross Site Scripting (XSS) issues. One in the HttpServletResponse.sendError method (CVE-2008-1232) and the other in the Tomcat Virtual Host Manager (CVE-2008-1947). These may allow a local or remote unprivileged user to inject arbitrary web script or HTML, which in turn may allow the unprivileged user to bypass access control and gain access to unauthorized data.

The third security vulnerability is a Directory Traversal vulnerability in the RequestDispatcher class (CVE-2008-2370) that may allow a local or remote unprivileged user to bypass access control and gain access to unauthorized data.

Additional information regarding these issues is available at:

• CVE-2008-1232 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232
• CVE-2008-1947 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1947
• CVE-2008-2370 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370
  

Permalink | Comments [0]

A security vulnerability in the Solaris Secure Shell (SSH) software (see ssh(1)), when used with CBC-mode ciphers and (SSH protocol version 2), may allow a remote unprivileged user who is able to intercept SSH network traffic to gain access to a portion of plain text information from intercepted traffic which would otherwise be encrypted.

This issue is also referenced in the following documents:

Permalink | Comments [0]

An insufficient validation vulnerability in named(1m) due to incorrectly processing the return value of OpenSSL library functions "EVP_VerifyFinal()" and "DSA_do_verify()" may allow a remote unprivileged user to trick named(1m) into believing DNSSEC signatures that should not have passed validation, and subsequently forge DNS responses and redirect Internet services.

Sun acknowledges with thanks, Google Security Team (for the original OpenSSL issue),  Florian Weimer for spotting that BIND was vulnerable and the ISC for for bringing this issue to our attention.

This issue is also referenced in the following documents:

• CVE-2009-0025 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025
• https://www.isc.org/node/389
  

Permalink |

A security vulnerability in the Solaris Kerberos (see kerberos(5)) pam_krb5(5) PAM module may allow a user supplied Kerberos configuration file to be used to specify realm and KDC server information, thereby allowing certain remote unprivileged users or applications to gain elevated privileges.

Sun acknowledges with thanks, Russ Allbery and Steven Luo for bringing this issue to our attention.

This issue is also described in the following documents:

Permalink |

A Security Vulnerability in Sun Java System Directory Proxy Server (a component of Sun Java System Directory Server Enterprise Edition) may allow a local or remote unprivileged user to make the Directory Proxy Server unresponsive to certain requests implying a JDBC backend. This is a type of Denial of Service (DoS).

Permalink |

A security vulnerability in Sun Java System Directory Server may allow a local or remote unprivileged user to create specifically crafted LDAP requests that would crash the directory server process. This is a type of Denial of Service (DoS).

Permalink |

There are two security vulnerabilities in the libxml2 library (see libxml2(3)) bundled with Solaris 9 and Solaris 10 which may impact applications making use of this library. The precise impact will vary depending on the application.

The first issue is an integer overflow in the xmlBufferResize() libxml2 function (CVE-2008-4225) which may allow a local or remote unprivileged user who provides a specially crafted XML file to cause a Denial of Service (DoS) to the application which is using the libxml2 library (or potentially to the system as a whole as the application may consume excessive resources).

The second issue is an integer overflow in the xmlSAX2Characters() libxml2 function (CVE-2008-4226) which may allow a local or remote unprivileged user who provides a specially crafted XML file to cause an application crash or an arbitrary code execution with the privileges of the user running the application.

Additional information regarding these issues is available in the following documents:

Permalink | Comments [1]

A security vulnerability in the process file system (proc(4)) when interacting with the contract(4) file system may allow a local unprivileged user the ability to panic the system or execute arbitrary commands with all (super-user) privileges. The ability to panic a system is a type of Denial of Service (DoS).

Sun acknowledges with thanks, Ilja van Sprundel from IOActive for bringing this issue to our attention.

This issue is also referenced in the following IOActive advisory:

• http://www.ioactive.com/pdfs/OpenSolarisUPtrDeref.pdf
  

Permalink |

An information disclosure security vulnerability in Samba (SAMBA(7)) may allow a remote unprivileged user to read arbitrary memory buffer contents and cause a Denial of Service (DoS) via crafted requests.

Additional information on this issue can be found in the following document:

Permalink |

A security vulnerability in the Solaris "autofs" kernel module may allow a local unprivileged user to cause "autofs" mounts to break, which is a type of Denial of Service (DoS). In rare occurrences, this may allow an unprivileged user to execute code as a root user.

Permalink |

Security vulnerability within the Solaris IP(7p) (Internet Protocol) implementation related to the allocation of minor numbers may allow a local unprivileged user to open a large number of sockets, thereby resulting in a Denial of Service (DoS) condition to 32-bit applications. Depending on the system configuration, this may in turn affect the system as a whole, for example it may prevent new logins from completing successfully.

Permalink |

Security vulnerabilities in the Embedded Lights Out Manager (ELOM) on Sun Fire X2100 M2 and X2200 M2 servers may allow remote unprivileged users to gain unauthorized login access with all privileges to the ELOM or execute arbitrary commands on the Service Processor (SP).

Sun acknowledges with thanks, Tomas Kopal for discovering and reporting one of the above two issues.

Permalink |

A security vulnerability in the Solaris ip(7P) kernel module's IP-in-IP packet processing may allow a local unprivileged user to cause a system panic, resulting in a Denial of Service (DoS).

Sun acknowledges with thanks, Evgeny Sonyagin for discovering and reporting this issue.

Permalink |

A security vulnerability in Sun Java System Access Manager may allow a remote unprivileged user to determine the existence of "guessed" usernames.

Sun acknowledges with thanks, Marco Mella (http://www.aboutsecurity.net/) for bringing this issue to our attention.

Permalink |