Original issue date: August 5, 1996<BR>
Last revised: October 20, 1997<BR>
              Vendor information for Sun has been added to the UPDATES
              section.

<P>A complete revision history is at the end of this file.

<P>The text of this advisory was originally released on July 30, 1996, as
   AUSCERT Advisory AL-96.03, developed by the Australian Computer Emergency
   Response Team. Because of the seriousness of the problem, we are reprinting
   the AUSCERT advisory here with their permission. Only the contact
   information at the end has changed: AUSCERT contact information has been
   replaced with CERT/CC contact information.

<P>We will update this advisory as we receive additional information.
   Please check advisory files regularly for updates that relate to your site.

<P><HR>

<P>AUSCERT has received a report of a vulnerability in the Sun Microsystems
Solaris 2.x distribution involving the program admintool.  This program is
used to provide a graphical user interface to numerous system administration
tasks.

<P>This vulnerability may allow a local user to gain root privileges.

<P>Exploit details involving this vulnerability have been made publicly
available.

<P>At this stage, AUSCERT is not aware of any official patches.  AUSCERT
recommends that sites take the actions suggested in Section 3 until official
patches are available.

<P><HR>
<H2>1.  Description</H2>

    admintool is a graphical user interface that enables an administrator to
    perform several system administration tasks on a system.  These tasks
    include the ability to manage users, groups, hosts and other services.

<P>To help prevent different users updating system files simultaneously,
    admintool uses temporary files as a locking mechanism.  The handling of
    these temporary files is not performed in a secure manner, and hence it
    may be possible to manipulate admintool into creating or writing to
    arbitrary files on the system.  These files are accessed with the
    effective uid of the process executing admintool.

<P>In Solaris 2.5, admintool is set-user-id root by default.  That is, all
    file accesses are performed with the effective uid of root.  An effect
    of this is that the vulnerability will allow access to any file on the
    system.  If the vulnerability is exploited to try and create a file that
    already exists, the contents of that file will be deleted.  If the file
    does not exist, it will be created with root ownership and be world
    writable.

<P>In earlier versions of Solaris 2.x, admintool is not set-user-id root
    by default.  In this case, admintool runs only with the privileges of
    the user executing it.  However, local users may wait for a specific user
    to execute admintool, exploiting the vulnerability to create or write
    files with that specific users' privileges.  Again, files created in this
    manner will be world writable.
<H2>2.  Impact</H2>
    A local user may be able to create or write to arbitrary files on the
    system.  This can be leveraged to gain root privileges.
<H2>3.  Workarounds/Solution</H2>
    Currently, AUSCERT is not aware of any official patches which address
    this vulnerability.  When official patches are made available, AUSCERT
    suggests that they be installed.

<P>Until official patches are available sites are encouraged to
    completely prevent execution of admintool by any user (including root).
<PRE>

        # chmod 400 /usr/bin/admintool
        # ls -l /usr/bin/admintool
        -r--------   1 root  sys  303516 Oct 27  1995 /usr/bin/admintool

</PRE>

<P>Note that if only the setuid permissions are removed, it is still possible
    for users to gain privileges when admintool is executed as root.

<P>AUSCERT recommends that, where possible, admintool should not be used at
    all until official patches are available.  In the interim, system
    administrators should perform administration tasks by using the command
    line equivalents.  More details on performing these tasks may be found
    in the Sun documentation set.

<P><HR>

<P>AUSCERT wishes to thank Brian Meilak (QUT), Marek Krawus (UQ), Leif
Hedstrom, Kim Holburn and Michael James for their assistance in this matter.

<P><HR>

<P>
<H2>UPDATES</H2>
 
<H3>Vendor Information</H3>
 
Below is information we have received from vendors. If you do not see your
vendor's name below, contact the vendor directly for information.
<H3>Sun Microsystems, Inc.</H3>
 
Sun Microsystems has provided the following list of patches in response
to this advisory: 
<UL>
        103558-10 5.5.1 
    <BR>    103559-07 5.5.1_x86 
        <BR>103247-07 5.5    
        <BR>103245-08 5.5_x86
</UL>

<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 1996 Carnegie Mellon University.</P>

<HR>

Revision History
<PRE>
 
Oct. 20, 1997  Vendor information for Sun has been added to the UPDATES
                 section.
Sep. 24, 1997  Updated copyright statement
Aug. 30, 1996  Removed references to CA-96.16.README.
               Beginning of the advisory - removed AUSCERT advisory header
                 to avoid confusion.

</PRE>