## SunView Selection_Svc Vulnerability

### Risk Factor: 7

### Machines Affected:

SunOS machines running 3.5 and before, 4.0, 4.0.1, 4.0.3, and 4.1 and all platforms (Sun3, Sun4, 386i)

### Description:

This vulnerability allows any remote system to read selected files from the workstation running SunView. This vulnerability is in the SunView (aka SunTools) selection_svc, and may be exploitable after the user quits using SunView. This problem cannot be exploited while X11 is in use (unless the user runs X11 after running SunView facility and can be exploited while SunView is in use). This problem is specific to Sun's SunView software.

SunView/SunTools start up the SunView environment and a default layout of a few useful "tools," or window-based applications. If the file .sunview or .suntools is present in a user's home directory when the user starts up sunview(1), sunview starts up the "tools", or window-based applications. You can use a .sunview or .suntools file to customize your desktop layout. A "selection service" is started automatically by sunview(1). However, you can also start one explicitly using the selection_svc command.

Selection_svc is used to modify resource files and cut & paste selections. This is done through RPC, and the selection service will accept requests from any user - local or remote. By executing:

    rpcinfo -b selection_svc 6

you will recieve a list of systems running selection_svc on your broadcast network. On Solaris x86 systems selection_svc is started when /etc/init runs /etc/rc. Since /etc/init runs as root, you can tell it to read any file.

### Consequences:

It is possible to read any file on the system, either locally or remotely

### Fix:

Install the X-11 windowing system, or obtain the patch from Sun below.

Links for advisories/more info
Cert CA-90:05
CIAC advisory a-32
Underground.org
Sun OS Patch ID: 100085-XX at Sun Patches