Vulnerabilities > CVE-2009-2857 - Improper Locking vulnerability in Oracle Opensolaris and Solaris

047910
CVSS 5.5 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
local
low complexity
oracle
CWE-667
nessus
NVD
Published: 2009-08-19
Updated: 2024-02-15

Summary

The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtual-memory implementations, which allows local users to cause a denial of service (deadlock and system halt) via vectors involving mmap and write operations on the same file.

Vulnerable Configurations

Part Description Count
OS
Oracle
5

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Race Conditions via Symbolic Links
    This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to her. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file she will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.

Nessus

NASL familySolaris Local Security Checks
NASL idSOLARIS8_127721.NASL
descriptionSunOS 5.8: kernel patch. Date this patch was last updated by Sun : Apr/11/11
last seen2016-09-26
modified2012-06-14
plugin id40611
published2009-08-18
reporterTenable
sourcehttps://www.tenable.com/plugins/index.php?view=single&id=40611
titleSolaris 8 (sparc) : 127721-06
code
#%NASL_MIN_LEVEL 999999

# @DEPRECATED@
#
# This script has been deprecated as the associated patch is not
# currently a recommended security fix.
#
# Disabled on 2011/09/17.

#
# (C) Tenable Network Security, Inc.
#
#

if ( ! defined_func("bn_random") ) exit(0);
include("compat.inc");

if(description)
{
 script_id(40611);
 script_version("1.16");

 script_name(english: "Solaris 8 (sparc) : 127721-06");
 script_cve_id("CVE-2009-2857", "CVE-2009-2912", "CVE-2011-0812", "CVE-2011-0813");
 script_set_attribute(attribute: "synopsis", value:
"The remote host is missing Sun Security Patch number 127721-06");
 script_set_attribute(attribute: "description", value:
'SunOS 5.8: kernel patch.
Date this patch was last updated by Sun : Apr/11/11');
 script_set_attribute(attribute: "solution", value:
"You should install this patch for your system to be up-to-date.");
 script_set_attribute(attribute: "see_also", value:
"https://getupdates.oracle.com/readme/127721-06");
 script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
 script_cwe_id(399);
 script_set_attribute(attribute:"plugin_publication_date", value: "2009/08/18");
 script_cvs_date("Date: 2018/08/13 14:32:38");
 script_end_attributes();

 script_summary(english: "Check for patch 127721-06");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
 family["english"] = "Solaris Local Security Checks";
 script_family(english:family["english"]);
 
 script_dependencies("ssh_get_info.nasl");
 script_require_keys("Host/Solaris/showrev");
 exit(0);
}



# Deprecated.
exit(0, "The associated patch is not currently a recommended security fix.");

include("solaris.inc");

e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWcar", version:"11.8.0,REV=2000.01.08.18.12");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWcar", version:"11.8.0,REV=2000.01.13.13.40");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWcarx", version:"11.8.0,REV=2000.01.08.18.12");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWcarx", version:"11.8.0,REV=2000.01.13.13.40");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWcsr", version:"11.8.0,REV=2000.01.08.18.12");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWcsu", version:"11.8.0,REV=2000.01.08.18.12");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWcsxu", version:"11.8.0,REV=2000.01.08.18.12");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWhea", version:"11.8.0,REV=2000.01.08.18.12");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWudfr", version:"11.8.0,REV=2000.01.08.18.12");
e +=  solaris_check_patch(release:"5.8", arch:"sparc", patch:"127721-06", obsoleted_by:"", package:"SUNWudfrx", version:"11.8.0,REV=2000.01.08.18.12");
if ( e < 0 ) { 
	if ( NASL_LEVEL < 3000 ) 
	   security_warning(0);
	else  
	   security_warning(port:0, extra:solaris_get_report());
	exit(0); 
} 
exit(0, "Host is not affected");

Oval

accepted2009-09-28T04:00:15.555-04:00
classvulnerability
contributors
namePai Peng
organizationHewlett-Packard
definition_extensions
  • commentSolaris 8 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1539
  • commentSolaris 9 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1457
  • commentSolaris 10 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1440
  • commentSolaris 8 (x86) is installed
    ovaloval:org.mitre.oval:def:2059
  • commentSolaris 9 (x86) is installed
    ovaloval:org.mitre.oval:def:1683
  • commentSolaris 10 (x86) is installed
    ovaloval:org.mitre.oval:def:1926
descriptionThe kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtual-memory implementations, which allows local users to cause a denial of service (deadlock and system halt) via vectors involving mmap and write operations on the same file.
familyunix
idoval:org.mitre.oval:def:6152
statusaccepted
submitted2009-08-21T11:07:35.000-04:00
titleSecurity Vulnerability in the Solaris Kernel Involving the Interaction of the Filesystem and Virtual Memory Subsystems
version34

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 36060 CVE(CAN) ID: CVE-2009-2857 Solaris是一款由Sun开发和维护的商业UNIX操作系统。 Solaris内核没有正确地处理文件系统与虚拟内存实现之间的交互，本地用户可以通过对同一文件执行mmap和write操作导致死锁和系统挂起。系统可能逐渐变慢，最终停止所有的活动。 Sun Solaris 9.0_x86 Sun Solaris 9.0 Sun Solaris 8.0_x86 Sun Solaris 8.0 Sun Solaris 10.0_x86 Sun Solaris 10.0 Sun OpenSolaris snv_01 - snv_102 厂商补丁： Sun --- Sun已经为此发布了一个安全公告（Sun-Alert-257848）以及相应补丁: Sun-Alert-257848：Security Vulnerability in the Solaris Kernel Involving the Interaction of the Filesystem and Virtual Memory Subsystems 链接：http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-257848-1
idSSV:12114
last seen2017-11-19
modified2009-08-26
published2009-08-26
reporterRoot
titleSun Solaris文件系统与虚拟内存子系统交互拒绝服务漏洞

References