Vigil@nce: OpenSolaris, non audit of hald
January 2010 by Vigil@nce
When Solaris Auditing is enabled, the hald daemon does not log its events.
Provenance: user shell
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 07/01/2010
DESCRIPTION OF THE VULNERABILITY
The hald (Hardware Abstraction Layer) daemon is used to detect and manage available hardware devices.
When Solaris Auditing is enabled, the hald daemon should log its events. However, it does not have the "proc_audit" privilege, and thus it cannot log its events.
A local attacker can for example add a hardware device, without being detected by the administrator.
Identifiers: 274830, 6905945, BID-37656, VIGILANCE-VUL-9328