Sun Cluster Global File System unspecified information disclosure
| suncluster-unspecified-info-disclosure (42762) |  Medium Risk |
Description:
An unspecified vulnerability in Sun Cluster Global File System could allow a local attacker to obtain sensitive information. An attacker could exploit this vulnerability to read arbitrary data from the deleted files of another user and possibly manipulate data to launch further attacks on the vulnerable system.
Platforms Affected:
- Sun, Cluster 3.1
- Sun, Solaris 10 x86
- Sun, Solaris 10 SPARC
- Sun, Solaris 8 SPARC
- Sun, Solaris 9 SPARC
- Sun, Solaris 9 x86
Remedy:
Refer to Sun Alert ID: 201341 for patch, upgrade or suggested workaround information. See References.
Consequences:
Obtain Information
References:
- Sun Alert ID: 201341, A Security Vulnerability in the Sun Cluster Global File System at http://sunsolve.sun.com/search/document.do?assetkey=1-66-201341-1.
- ASA-2008-238: A Security Vulnerability in the Sun Cluster Global File System (Sun 201341)
- BID-29458: Sun Cluster Global File System Unspecified Security Vulnerability
- CVE-2008-2539: The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors.
- SA30483: Sun Cluster Global File System Unspecified Vulnerability
- SECTRACK ID: 1020152: Sun Cluster Global File System May Disclose a User's Deleted Files to Other Local Users
- VUPEN/ADV-2008-1713: Sun Cluster Global File System Local Data Disclosure Vulnerability
Reported:
May 30, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net