Re: Immunity Advisory: Solaris local kernel root

[Dave Aitel]

Casper Dik wrote:

>I wonder why you even bother publishing this; at the time the document
>claims to have been written, half the listed Solaris revisions had already
>patches out for them; Solaris 10, which technically doesn't exist yet, had
>the bug already fixed in its most recent Solaris Express builds.
>
>

By our math, January 22nd, 2004 is after December 2003, which is when
this exploit was first made available to Vulnerability Sharing Club
members. At that point there were no patches for any Solaris, as far as
we were aware. We would like to think that the additional information we
provided, including a working exploit, was valuable to many members of
the information security community.

Thanks,
Dave Aitel
Vice President, Public and Media Relations
Immunity, Inc.
http://www.immunitysec.com/CANVAS/ "Hacking for non assembly programers"
646-327-8429

[Casper Dik]

>Casper Dik wrote:
>
>>I wonder why you even bother publishing this; at the time the document
>>claims to have been written, half the listed Solaris revisions had already
>>patches out for them; Solaris 10, which technically doesn't exist yet, had
>>the bug already fixed in its most recent Solaris Express builds.
>>
>>
>
>By our math, January 22nd, 2004 is after December 2003, which is when
>this exploit was first made available to Vulnerability Sharing Club
>members. At that point there were no patches for any Solaris, as far as
>we were aware. We would like to think that the additional information we
>provided, including a working exploit, was valuable to many members of
>the information security community.


The Solaris 7 patch was released December 1st;
the Solaris 8 patch was released November 25th;
the Solaris 9 patch was released December 23rd;

the delay in the Sun Alert notication was probably due to
the late release date of the Solaris 9/Intel patch.


Had you notified Sun, which you should have done, we would
have given you this information.

You see, I am very suspicious about people independently "discovering"
bugs after we've posted patches or filed them to our internal
bugtracking system. Or people sitting on discovered security vulnerabilities
for many years. The latter people are part of the problem, not of
the solution.

Casper

[Dave Aitel]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Casper Dik wrote:

| [snipped]
|
| You see, I am very suspicious about people independently
| "discovering" bugs after we've posted patches or filed them to our
| internal bugtracking system. Or people sitting on discovered
| security vulnerabilities for many years. The latter people are
| part of the problem, not of the solution.
|
| Casper

Yes, no doubt telling the world that you think Sun's internal
bugtracking system has been compromised is getting that consumer
confidence right back up! :>

Dave Aitel
Chief Officer of Suspicion and Paranoia
Immunity, Inc.
http://www.immunitysec.com/CANVAS/ "Exploit your systems by directly
tapping into Sun's secret bug database!"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAYzE2zOrqAtg8JS8RAjSmAKDd1R4PyHALenoefyBRGS rmVh0d1gCg6pO5
OxGV1sbNwGkIG2jVjs+9E5g=
=8uk4
-----END PGP SIGNATURE-----