Vigil@nce: OpenSolaris, non audit of hald
January 2010 by Vigil@nce
When Solaris Auditing is enabled, the hald daemon does not log its
events.
– Severity: 1/4
– Consequences: disguisement
– Provenance: user shell
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 07/01/2010
IMPACTED PRODUCTS
– OpenSolaris
DESCRIPTION OF THE VULNERABILITY
The hald (Hardware Abstraction Layer) daemon is used to detect and
manage available hardware devices.
When Solaris Auditing is enabled, the hald daemon should log its
events. However, it does not have the "proc_audit" privilege, and
thus it cannot log its events.
A local attacker can for example add a hardware device, without
being detected by the administrator.
CHARACTERISTICS
– Identifiers: 274830, 6905945, BID-37656, VIGILANCE-VUL-9328
– Url: http://vigilance.fr/vulnerability/OpenSolaris-non-audit-of-hald-9328