PT-1995-1021 · Sun · Sunos

Published 1995-05-10 · Updated 2018-05-03 · CVE-1999-1080

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SunOS version 5.7

Description The issue allows local users with physical access to potentially gain root privileges by mounting a floppy or CD-ROM that contains a setuid program and running volcheck. This occurs because rmmount in SunOS 5.7 may mount file systems without the nosuid flag set, contrary to the documentation and its use in previous versions of SunOS.

Recommendations For SunOS version 5.7, ensure that the nosuid flag is set for all file systems in rmmount.conf to prevent the mounting of file systems with setuid programs. As a temporary workaround, consider restricting physical access to the system and avoiding the use of volcheck on untrusted file systems until the issue is resolved.

Fix

Related Identifiers

CVE-1999-1080

Affected Products

Sunos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-1999-1080 · Security Note
• http://marc.info/?l=bugtraq&m=93971288323395&w=2 · Note
• http://marc.info/?l=bugtraq&m=92633694100270&w=2 · Note
• http://securityfocus.com/bid/250 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8350 · Note