Rechercher
Contactez-nous Suivez-nous sur Twitter En francais English Language
 

De la Théorie à la pratique





















Freely subscribe to our NEWSLETTER

Newsletter FR

Newsletter EN

Vulnérabilités

Unsubscribe

Vigil@nce: OpenSolaris, non audit of hald

January 2010 by Vigil@nce

When Solaris Auditing is enabled, the hald daemon does not log its events.

- Severity: 1/4
- Consequences: disguisement
- Provenance: user shell
- Means of attack: no proof of concept, no attack
- Ability of attacker: expert (4/4)
- Confidence: confirmed by the editor (5/5)
- Diffusion of the vulnerable configuration: high (3/3)
- Creation date: 07/01/2010

IMPACTED PRODUCTS

- OpenSolaris

DESCRIPTION OF THE VULNERABILITY

The hald (Hardware Abstraction Layer) daemon is used to detect and manage available hardware devices.

When Solaris Auditing is enabled, the hald daemon should log its events. However, it does not have the "proc_audit" privilege, and thus it cannot log its events.

A local attacker can for example add a hardware device, without being detected by the administrator.

CHARACTERISTICS

- Identifiers: 274830, 6905945, BID-37656, VIGILANCE-VUL-9328
- Url: http://vigilance.fr/vulnerability/O...




See previous articles

    

See next articles