Patch-ID# 110030-02 Keywords: security VRTSvmsa Synopsis: VRTSvmsa 3.0.4: Security patch Date: Jan/05/2001 Solaris Release: 2.5.1 2.6 7 8 SunOS Release: 5.5.1 5.6 5.7 5.8 Unbundled Product: VRTSvmsa Unbundled Release: 3.0.4 Xref: Topic: Relevant Architectures: sparc BugId's fixed with this patch: 4345464 Changes incorporated in this version: Patches accumulated and obsoleted by this patch: Patches which conflict with this patch: Patches required with this patch: Obsoleted by: Files included with this patch: /opt/VRTSvmsa/bin/vmsa_server Problem Description: Patch postinstall script updated to correct permissions and ownership of /var/opt/vmsa/logs/ (from 110030-01) 4345464 Veritas Volume Manager 3.0.x allows local users to gain root access A security issue in the Volume Manager Storage Administrator GUI server has been uncovered that may allow unauthorized users to enter commands into this file. Since the umask at boot time for Solaris versions prior to 8 is 000, the permissions for files such as/var/opt/vmsa/logs/.server_pids are set to 666. This allows any user to enter commands in this file, and these commands will be executed when vmsa_server is stopped by an administrator. System security is compromised as a result. Patch Installation Instructions: -------------------------------- Refer to the Install.info file for instructions on using the generic 'installpatch' and 'backoutpatch' scripts provided with each patch. Any other special or non-generic installation instructions should be described below as special instructions. Special Install Instructions: ----------------------------- None. README -- Last modified date: Thursday, December 13, 2001