A security vulnerability in the libdevinfo(3LIB) library, which is used by the login(1) command, may allow a local unprivileged user to gain unauthorized access to files on the system, possibly including system files. (see below for full details)

A security vulnerability in the libdevinfo(3LIB) library, which is used by the login(1) command, may allow a local unprivileged user to gain unauthorized access to files on the system, possibly including system files. This vulnerability could therefore be used to gain elevated privileges on the system.

This issue can occur in the following releases:

SPARC Platform

• Solaris 10 with patch 118833-04 or later and without patch 125251-02

x86 Platform

• Solaris 10 with patch 118855-03 or later and without patch 125252-02

Note: Solaris 8 and Solaris 9 Operating systems are not affected by this issue.

There are no reliable symptoms that would indicate the described issue has been exploited.

To work around this issue, edit "/etc/logindevperm" and replace all the "dev" entries in the 3rd column by "^dev$" as in the following example:

    /dev/console    0600    /^dev$/mouse:/^dev$/kbd
    /dev/console    0600    /^dev$/sound/*          # audio devices
    [...]

This change has no negative impact.

This issue is addressed in the following releases:

SPARC Platform

• Solaris 10 with patch 125251-02 or later

x86 Platform

• Solaris 10 with patch 125252-02 or later

For more information on Security Sun Alerts, see Sun Infodoc 91209.

This solution has no attachment