Sun battles two vulnerabilities with patch and workaround

Article

Sun battles two vulnerabilities with patch and workaround

Edmund X. DeJesus, Contributor

Security experts are warning of serious vulnerabilities in Sun Microsystems' OpenSSL and TLS implementation in Sun Cluster, and with Internet Key Exchange (IKE) in Solaris, that could allow remote unprivileged users to cause denial of service, execute arbitrary code or obtain unauthorized root access.

Known problems with OpenSSL Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols have surfaced in a number of products, now including

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Sun Cluster. The original issues involve bugs like an integer overflow and bad counting of input characters, which can permit a remote attacker to crash the application and cause denial of service or possibly execute arbitrary code. This occurs in Sun Cluster 3.x with SunPlex Manager. There's no fix at this time. According to Denmark-based security provider Secunia, Sun recommends stopping the SunPlex Manager.

The other issue is with the implementation of Internet Key Exchange in Solaris 9 on x86 systems. It's possible for a local or remote attacker to leverage a buffer overflow to cause a denial of service or obtain unauthorized root access. Sun has issued a patch.