CVE-1999-1428: Medium severity Sun Solstice Adminsuite vulnerability
Solaris Solstice AdminSuite (AdminSuite) 2.1 and 2.2 allows local users to gain privileges via the save option in the Database Manager, which is running with setgid bin privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Sun Solstice AdminSuitefrom your environment.Uninstall Sun Solstice AdminSuite if it is not required on the system.
- Configuration
Remove the setgid bit from the Database Manager binary so it no longer runs with setgid bin privileges and ensure ownership and permissions restrict execution to trusted administrator accounts (e.g., remove group execute privilege and/or use chmod g-s on the binary and set restrictive owner/group).
Solaris Solstice AdminSuite Database Manager setgid (group) privilege = remove setgid - Configuration
Disable the Database Manager 'save' option if configuration allows, or restrict its use so only trusted administrative accounts can invoke it.
Solaris Solstice AdminSuite Database Manager save option = disable or restrict to administrators - Compensating control
Restrict access to the host and to AdminSuite components: limit local user accounts and group membership, apply host-level access controls/ACLs or firewall rules to prevent unprivileged users from executing the Database Manager binary.
- Operational
Audit systems for signs of privilege escalation: review logs, verify Database Manager permissions and recent changes, and remediate any suspected compromises before restoring normal operation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1428?
CVE-1999-1428 is considered a high severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-1999-1428?
To fix CVE-1999-1428, you should upgrade to a version of Sun Solstice AdminSuite that does not contain this vulnerability.
Who is affected by CVE-1999-1428?
CVE-1999-1428 affects local users running Sun Solstice AdminSuite versions 2.1 and 2.2.
What type of attack is CVE-1999-1428 associated with?
CVE-1999-1428 is associated with local privilege escalation attacks.
Can CVE-1999-1428 be exploited remotely?
No, CVE-1999-1428 can only be exploited by local users who have access to the vulnerable system.