Local unprivileged users may be able to gain unauthorized root access due to a security vulnerability in the Solaris runtime linker (ld.so.1(1)).

This issue can occur in the following releases:

SPARC Platform:

• Solaris 8 with patches 109147-31 through 109147-36 and without patch 109147-37
• Solaris 9 with patches 112963-16 through 112963-21 and without patch 112963-22
• Solaris 10 without patch 117461-04

x86 Platform

• Solaris 8 with patches 109148-31 through 109148-36 and without patch 109148-37
• Solaris 9 with patches 113986-12 through 113986-17 and without patch 113986-18
• Solaris 10 without patch 118345-05

Note: Solaris 7 is not affected by this issue.

There are no reliable symptoms that would indicate the described issue has been exploited to gain elevated privileges.

To work around the described issue, sites running Solaris 8 or Solaris 9 can back out the relevant linker patch to a revision which is not affected using the patchrm(1M) command. If the patch cannot be backed out, the ld.so.1(1M) file from an earlier patch can be replaced on the system using the following steps as the root user:

1. Copy the ld.so.1 file from the patch onto the system as shown in the following example:

    # cp ./SUNWcsu/reloc/usr/lib/ld.so.1 /usr/lib/ld.so.1-patch

2. Create a directory entry (link) for the existing runtime linker to a new file using ln(1):

    # cd /usr/lib ; ln ld.so.1 ld.so.1.original

3. Create a directory entry (link) for the patched runtime linker copied earlier to the current runtime linker, again using ln(1):

    # cd /usr/lib ; ln ld.so.1-patch ld.so.1

4. For SPARC systems running in 64-bit mode, the runtime linker located in the patch at:

    ./SUNWcsxu/reloc/usr/lib/sparcv9/ld.so.1

will need to be copied to "/usr/lib/sparcv9". The above steps can then be repeated using the "/usr/lib/sparcv9" path instead of "/usr/lib".

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 109147-37 or later
• Solaris 9 with patch 112963-22 or later
• Solaris 10 with patch 117461-04 or later

x86 Platform

• Solaris 8 with patch 109148-37 or later
• Solaris 9 with patch 113986-18 or later
• Solaris 10 with patch 118345-05 or later

Change History

• Updated Relief/Workaround section

• Updated Relief/Workaround section

12-Jul-2005:

• Updated Relief/Workaround

• Updated Relief/Workaround section

• Updated Contributing Factors and Resolution sections

• Updated Contributing Factors, Relief/Workaround and Resolution sections

• Updated Contributing Factors and Resolution sections

• State: Resolved
• Updated Contributing Factors and Resolution sections

This solution has no attachment