A security vulnerability in Solaris 10 x64 kernel processing may allow a local unprivileged user the ability to cause a system panic, creating a Denial of Service (DoS) condition.

There are three vulnerabilities in Sun StorEdge Enterprise Backup Software (EBS), which affect both the client and server applications. Two of the vulnerabilities could permit a local or remote unauthorized user to gain access to a host system and execute arbitrary code. One may allow a local or remote unauthenticated user to cause a system crash on the server, which would lead to a Denial of Service (DoS) condition.

Note: To date there are no reported incidences of this issue having occurred in a "live" (public) environment.

These issues are referenced in the following iDEFENSE (http://www.idefense.com) documents:

IDEF1237 "...Networker nsrd.exe DoS Vulnerability" at http://www.idefense.com/intelligence/vulnerabilities/display.php?id=375

IDEF1238 "...Networker nsrexecd.exe Heap Overflow Vulnerability" at http://www.idefense.com/intelligence/vulnerabilities/display.php?id=374

IDEF1239 "...Networker nsrd.exe Heap Overflow Vulnerability" at http://www.idefense.com/intelligence/vulnerabilities/display.php?id=373

and also

CAN-2005-3658 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3658

CAN-2005-3659 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3659

Security vulnerabilities in lpsched(1M) may allow a local unprivileged user the ability to delete any file or disable the LP print service on a system configured as a print server.

Sun acknowledges, with thanks, Hiroshi Nakano of Ryukoku University for bringing these issues to our attention.

On Solaris 10 x86 systems, or on Solaris 9 x86 systems with patch 112234-11 or 112234-12 or patch 117172-16 (or later) installed, a local unprivileged user may have the ability to gain root access or panic the Solaris operating system.

A local unprivileged user running find(1) against the "/proc" filesystem may panic the system, creating a Denial of Service (DoS) condition.

Security vulnerabilities in the uucp(1C) and uustat(1C) utilities may allow local unprivileged users the ability to execute arbitrary commands with the privileges of the "uucp" user (user ID 5 by default).

The uustat(1C) issue is also referenced here:

• http://www.idefense.com/intelligence/vulnerabilities/display.php?id=366
• http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0780

Sun acknowledges, with thanks, iDefense Labs and Angelo Rosiello (http://www.rosiello.org/) for bringing the uustat(1C) issue to our attention.