Featuring 10 Papers as of May 5, 2005
Local Privilege Escalation in Solaris 8 and Solaris 9 via Buffer Overflow in passwd(1) by Shaun McAdams - May 5, 2005
While remote compromises are preferred by attackers and most feared by defenders, local privilege escalation can be equally as dangerous and even harder to uncover. A buffer overflow in the passwd program used in Sun Microsystems' Solaris 8 and Solaris 9 Operating Environments can be silently exploited by a valid local user to gain root privileges.
Solaris Patching: Problems, Solutions, and Open Issues by Julie Baumler - December 13, 2003
This paper takes a high level look at reasons to patch, the extent to which systems in the wild are being patched and the patch management process; specifically under current versions of Sun's Solaris Operating Environment.
The Security Implications of Unix Naming Services by Paul Kirtland - November 19, 2003
This paper will provide an overview of some of the security implications of Unix naming services with a view towards the adoption of an LDAP v3 based directory.
BSM Security Auditing for Solaris Servers by John Sun - June 27, 2003
This article discusses the pros and cons of BSM. It describes how to enable, configure, and manage the BSM auditing on Solaris servers to secure the system, and it offers a few solutions to overcome some problems and disadvantages of BSM.
Configuration and Patch Verification on Solaris Systems by Scott Cromar - February 25, 2003
In this paper, I discuss two configuration monitoring scripts which I have used to ensure that systems are up to patch and configuration standards.
Operating Environment Minimisation for Security by Jeffrey Bailey - March 25, 2002
This paper covers the concept of "Operating Environment Minimization for Security", how it relates to other host based security measures used today, guidelines and the application to the Sun Microsystems Solaris 8 operating environment.
Central Logging with a Twist of COTS in a Solaris Environment by Kent Stout - March 25, 2002
This paper will address how to set up a central logging system for a network of Solaris (Solaris version 8) machines, some of which will be hosting COTS products, including configuration of a central log server.
Security Features Overview of Merlin (J2SE Version 1.4) by Craig Walker - December 1, 2001
This paper provides an overview of the security feature of JavaTM 2 Standard Edition version 1.4.
Solaris C2 Auditing with BSM by Mohd Khir - November 17, 2001
This article is intended to introduce the C2 auditing capabilities of Solaris BSM.
Automation of the OS Installation and Security Hardening Process by Kyle Martin - August 27, 2001
This paper addresses the SOLARIS(TM) SECURITY TOOLKIT initiative which holds promise in providing secure installations and upgrades for repeatable, quick installations and upgrades within the Solaris Operating Environment.
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact email@example.com.
All papers are copyrighted. No re-posting or distribution of papers is permitted.