A security vulnerability in the kcms_calibrate(1) command may allow local unprivileged users to execute arbitrary commands with root privileges.

Sun acknowledges, with thanks, Cees-Bart Breunesse of the University of Nijmegen for bringing this issue to our attention.

This issue can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 111400-04
• Solaris 9 without patch 114636-04

x86 Platform

• Solaris 8 without patch 111401-04
• Solaris 9 without patch 114637-04

Note: Solaris 10 is not affected by this issue since the Kodak Color Management System (KCMS) no longer ships in Solaris 10 and later.

There are no predictable symptoms that would indicate the described issue has been exploited to execute arbitrary code on a system.

To prevent this issue from occurring until the patches listed in section 5 can be applied, the set-user-ID bit can be removed from the kcms_calibrate(1) binary using the following command as the root (uid 0) user:

    # chmod u-s /usr/openwin/bin/kcms_calibrate

Alternatively if the Kodak Color Management System (KCMS) utilities are not being used the following packages can be removed from the system using pkgrm(1M):

Core KCMS packages:

    application SUNWkcslx   KCMS Runtime Library (64-bit)
    application SUNWkcspf   KCMS Optional Profiles
    application SUNWkcspg   KCMS Programmers Environment
    application SUNWkcspx   KCMS Programmers Environment (64-bit)
    system      SUNWkcsrl   KCMS Runtime Library Support
    system      SUNWkcsrr   KCMS Runtime Profiles
    application SUNWkcsrt   KCMS Runtime Environment
    application SUNWkcsrx   KCMS Runtime Environment (64-bit)

Translated KCMS packages:

    ALE         SUNWckcsr   Simplified Chinese (EUC) KCMS Runtime Environment
    application SUNWdkcsr   German KCMS Runtime Environment
    application SUNWekcsr   Spanish KCMS Runtime Environment
    application SUNWfkcsr   French KCMS Runtime Environment
    ALE         SUNWhkcsr   Traditional Chinese (EUC) KCMS Runtime Environment
    application SUNWikcsr   Italian KCMS Runtime Environment
    application SUNWjkcsr   Japanese KCMS Runtime Environment
    ALE         SUNWkkcsr   Korean (EUC) KCMS Runtime Environment
    application SUNWskcsr   Swedish KCMS Runtime Environment

The following command uses pkgrm(1) as the root user to remove all of the above packages:

    # pkgrm SUNWkcslx SUNWkcspf SUNWkcspg SUNWkcspx SUNWkcsrl SUNWkcsrr \
    SUNWkcsrt SUNWkcsrx SUNWckcsr SUNWdkcsr SUNWekcsr SUNWfkcsr SUNWhkcsr \
    SUNWikcsr SUNWjkcsr SUNWkkcsr SUNWskcsr

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 111400-04 or later
• Solaris 9 with patch 114636-04 or later

x86 Platform

• Solaris 8 with patch 111401-04 or later
• Solaris 9 with patch 114637-04 or later

This solution has no attachment