Rechercher
Contactez-nous Suivez-nous sur Twitter En francais English Language
 

Freely subscribe to our NEWSLETTER

Newsletter FR

Newsletter EN

Vulnérabilités

Unsubscribe

Vigil@nce: OpenSolaris, non audit of hald

January 2010 by Vigil@nce

When Solaris Auditing is enabled, the hald daemon does not log its
events.

 Severity: 1/4
 Consequences: disguisement
 Provenance: user shell
 Means of attack: no proof of concept, no attack
 Ability of attacker: expert (4/4)
 Confidence: confirmed by the editor (5/5)
 Diffusion of the vulnerable configuration: high (3/3)
 Creation date: 07/01/2010

IMPACTED PRODUCTS

 OpenSolaris

DESCRIPTION OF THE VULNERABILITY

The hald (Hardware Abstraction Layer) daemon is used to detect and
manage available hardware devices.

When Solaris Auditing is enabled, the hald daemon should log its
events. However, it does not have the "proc_audit" privilege, and
thus it cannot log its events.

A local attacker can for example add a hardware device, without
being detected by the administrator.

CHARACTERISTICS

 Identifiers: 274830, 6905945, BID-37656, VIGILANCE-VUL-9328
 Url: http://vigilance.fr/vulnerability/OpenSolaris-non-audit-of-hald-9328


See previous articles

    

See next articles


Your podcast Here

New, you can have your Podcast here. Contact us for more information ask:
Marc Brami
Phone: +33 1 40 92 05 55
Mail: ipsimp@free.fr

All new podcasts