Vulnerabilities > CVE-2008-1684 - Race Condition vulnerability in SUN Solaris 10

047910
CVSS 4.7 - MEDIUM
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
local
sun
CWE-362
nessus
NVD
Published: 2008-04-06
Updated: 2017-09-29

Summary

inetd on Sun Solaris 10, when debug logging is enabled, allows local users to write to arbitrary files via a symlink attack on the /var/tmp/inetd.log temporary file.

Vulnerable Configurations

Part Description Count
OS
Sun
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
    This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.

Nessus

  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_127718.NASL
    descriptionSunOS 5.10: svc.startd and rpc.metad patch. Date this patch was last updated by Sun : Apr/01/08
    last seen2018-09-01
    modified2018-08-13
    plugin id31759
    published2008-04-04
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=31759
    titleSolaris 10 (sparc) : 127718-05
    code
    #%NASL_MIN_LEVEL 80502

# @DEPRECATED@
#
# This script has been deprecated as the associated patch is not
# currently a recommended security fix.
#
# Disabled on 2011/10/24.
#

#
# (C) Tenable Network Security, Inc.
#
#

if ( ! defined_func("bn_random") ) exit(0);
include("compat.inc");

if(description)
{
 script_id(31759);
 script_version("1.17");

 script_name(english: "Solaris 10 (sparc) : 127718-05");
 script_cve_id("CVE-2008-1684");
 script_set_attribute(attribute: "synopsis", value:
"The remote host is missing Sun Security Patch number 127718-05");
 script_set_attribute(attribute: "description", value:
'SunOS 5.10: svc.startd and rpc.metad patch.
Date this patch was last updated by Sun : Apr/01/08');
 script_set_attribute(attribute: "solution", value:
"You should install this patch for your system to be up-to-date.");
 script_set_attribute(attribute: "see_also", value:
"http://download.oracle.com/sunalerts/1019015.1.html");
 script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C");
 script_cwe_id(59,362);
 script_set_attribute(attribute:"plugin_publication_date", value: "2008/04/04");
 script_cvs_date("Date: 2019/10/25 13:36:24");
 script_end_attributes();

 script_summary(english: "Check for patch 127718-05");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
 family["english"] = "Solaris Local Security Checks";
 script_family(english:family["english"]);
 
 script_dependencies("ssh_get_info.nasl");
 script_require_keys("Host/Solaris/showrev");
 exit(0);
}

# Deprecated.
exit(0, "The associated patch is not currently a recommended security fix.");
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_X86_127719.NASL
    descriptionSunOS 5.10_x86: svc.startd and rpc.metad p. Date this patch was last updated by Sun : Apr/01/08
    last seen2018-09-01
    modified2018-08-13
    plugin id31334
    published2008-03-04
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=31334
    titleSolaris 10 (x86) : 127719-05
    code
    #%NASL_MIN_LEVEL 80502

# @DEPRECATED@
#
# This script has been deprecated as the associated patch is not
# currently a recommended security fix.
#
# Disabled on 2011/10/24.
#

#
# (C) Tenable Network Security, Inc.
#
#

if ( ! defined_func("bn_random") ) exit(0);
include("compat.inc");

if(description)
{
 script_id(31334);
 script_version("1.17");

 script_name(english: "Solaris 10 (x86) : 127719-05");
 script_cve_id("CVE-2008-1684");
 script_set_attribute(attribute: "synopsis", value:
"The remote host is missing Sun Security Patch number 127719-05");
 script_set_attribute(attribute: "description", value:
'SunOS 5.10_x86: svc.startd and rpc.metad p.
Date this patch was last updated by Sun : Apr/01/08');
 script_set_attribute(attribute: "solution", value:
"You should install this patch for your system to be up-to-date.");
 script_set_attribute(attribute: "see_also", value:
"http://download.oracle.com/sunalerts/1019015.1.html");
 script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C");
 script_cwe_id(59,362);
 script_set_attribute(attribute:"plugin_publication_date", value: "2008/03/04");
 script_cvs_date("Date: 2019/10/25 13:36:24");
 script_end_attributes();

 script_summary(english: "Check for patch 127719-05");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
 family["english"] = "Solaris Local Security Checks";
 script_family(english:family["english"]);
 
 script_dependencies("ssh_get_info.nasl");
 script_require_keys("Host/Solaris/showrev");
 exit(0);
}

# Deprecated.
exit(0, "The associated patch is not currently a recommended security fix.");

Oval

accepted2008-05-19T04:00:13.301-04:00
classvulnerability
contributors
namePai Peng
organizationHewlett-Packard
definition_extensions
  • commentSolaris 10 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1440
  • commentSolaris 10 (x86) is installed
    ovaloval:org.mitre.oval:def:1926
descriptioninetd on Sun Solaris 10, when debug logging is enabled, allows local users to write to arbitrary files via a symlink attack on the /var/tmp/inetd.log temporary file.
familyunix
idoval:org.mitre.oval:def:5369
statusaccepted
submitted2008-04-08T07:20:30.000-04:00
titleSecurity Vulnerability in inetd(1M) Daemon When Debug Logging is Enabled
version35

References