A local user who has been granted the "solaris.cluster.gui" authorization may be able to view files which would normally be inaccessible to that user due to a security vulnerability in the Sun Cluster SunPlex Manager GUI.

This issue can occur in the following releases:

SPARC Platform

• Sun Cluster 3.1 4/04 (for Solaris 8 and 9)

x86 Platform

• Sun Cluster 3.1 4/04 (for Solaris 9)

Notes:

1. Sun Cluster 3.1 4/04 is not supported on Solaris 10.
2. Sun Cluster 3.1 versions later than 4/04 are not affected by this issue.
3. Sun Cluster 3.0 and earlier are not affected by this issue.

To determine if Sun Cluster 3.1 4/04 is installed on a system, the following command can be run:

    $ /usr/cluster/bin/scinstall -p | grep 3.1u2
    3.1u2

If the system returns 3.1u2 (as in the example above), then it is impacted by this issue.

To determine if a local user has been granted the "solaris.cluster.gui" the auths(1) command can be used, as in the following example:

    $ auths username
    solaris.system.date,solaris.cluster.gui

There are no predictable symptoms that would indicate the described issue has occurred.

To work around the described issue, temporarily disable SunPlex Manager by running the script as shown below (as 'root'):

    # /etc/init.d/initspm stop

Note: Disabling this service will mean that users will be unable to administer the Sun Cluster software using the SunPlex Manager Software.

This issue is addressed in the following releases:

SPARC Platform

• Sun Cluster 3.1 9/04 (for Solaris 8 and 9) or later

x86 Platform

• Sun Cluster 3.1 9/04 (for Solaris 9) or later

Note: It is necessary to install or upgrade to Sun Cluster 3.1 9/04 or later.

This solution has no attachment