Sun has issued a security alert for Sun Solaris to raise awareness of the known insecure default configuration of sadmind (Solstice Administration Daemon) because an exploit has been discovered in the wild.

The security issue is caused due to default use of the insecure "AUTH_SYS" authentication mechanism, which should only be used on "trusted" networks since client credentials are easily forged.

This can be exploited to execute arbitrary commands on the system with the privileges of the sadmind daemon (typically "root") by sending a specially crafted sequence of RPC (Remote Procedure Call) requests forging the client credentials.

Solution
Sun is not planning on releasing any patches. However, administrators are advised to use one of the following solutions:
Further details available in Customer Area

Provided and/or discovered by
Mark Zielinski
iDEFENSE

Changelog
Further details available in Customer Area

Original Advisory
Sun advisory:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/56740

iDEFENSE advisory:
http://www.idefense.com/advisory/09.16.03.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area