----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
Sun Solaris iSCSI Management Commands Privilege Escalation

SECUNIA ADVISORY ID:
SA36801

VERIFY ADVISORY:
http://secunia.com/advisories/36801/

DESCRIPTION:
A vulnerability has been reported in Sun Solaris, which can be
exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to an unspecified error in the
Solaris iSCSI management commands "iscsiadm" and "iscsitadm". This
can be exploited to execute arbitrary commands with escalated
privileges.

Successful exploitation requires that the user has been assigned an
RBAC execution profile, which specifies additional privileges for the
"iscsiadm" or "iscsitadm" commands, e.g. the "File System Management"
profile.

The vulnerability is reported in Solaris 10 with patch 119090-16
through 119090-32 (SPARC platform) or with patch 119091-16 through
119091-33 (x86 platform) and OpenSolaris based upon builds snv_28
through snv_109.

SOLUTION:
Apply patches.

-- SPARC Platform --

Solaris 10:
Apply patch 119090-33 or later.

OpenSolaris:
Fixed in build snv_110 or later.

-- x86 Platform --

Solaris 10:
Apply patch 119091-34 or later.

OpenSolaris:
Fixed in build snv_110 or later.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-261849-1

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------