PT-2003-2015 · Sun · Xsun

Published 2003-12-03 · Updated 2018-10-30 · CVE-2003-1058

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xsun server for Sun Solaris versions 2.6 through 9

Description The issue allows local users to cause a denial of service, resulting in an Xsun crash, or to create or overwrite arbitrary files on the system. This is likely achieved via a symlink attack on temporary server files when the Xsun server is running in Direct Graphics Access (DGA) mode.

Recommendations For Xsun server for Sun Solaris versions 2.6 through 9, consider disabling the DGA mode as a temporary workaround to minimize the risk of exploitation. Restrict access to temporary server files to prevent symlink attacks.

Fix

Related Identifiers

CVE-2003-1058

Affected Products

Xsun

References · 7

• http://ciac.org/ciac/bulletins/o-033.shtml · Vendor Advisory
• http://secunia.com/advisories/10346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1058 · Security Note
• http://osvdb.org/2892 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57419-1 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13890 · Note
• http://securityfocus.com/bid/9147 · Note