CVE-2003-1575 in File System
Summary
by MITRE
VERITAS File System (VxFS) 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass intended file permissions by accessing a file on a VxFS filesystem.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/29/2026
The vulnerability described in CVE-2003-1575 represents a significant security flaw in VERITAS File System implementations across multiple Solaris versions. This issue specifically targets the access control list inheritance mechanisms within VxFS 3.3.3, 3.4, and 3.5 versions before MP1 Rolling Patch 02, affecting systems running Solaris 2.5.1 through 9. The flaw manifests when directory inodes possess certain characteristics that cause the system to improperly handle default ACL inheritance, creating a pathway for unauthorized access to protected files and directories.
The technical implementation of this vulnerability stems from improper handling of access control list inheritance within the VxFS filesystem driver. When files are created within directories that have specific inode characteristics, the system fails to properly apply the intended default ACLs that should govern access permissions. This breakdown occurs during the file creation process where the filesystem does not correctly inherit or apply the default access controls that administrators have configured. The vulnerability specifically impacts the way the system processes directory inodes that contain certain metadata characteristics, causing the ACL inheritance mechanism to malfunction and potentially allow access to files that should be restricted based on the configured permissions.
The operational impact of this vulnerability extends beyond simple permission bypass scenarios and represents a critical compromise of the filesystem's security model. Local users who can access a VxFS filesystem with the affected versions can exploit this flaw to gain unauthorized access to files that should be protected by their configured permissions. This creates a scenario where users can potentially read, write, or execute files that they should not have access to based on their role or the intended security configuration. The vulnerability undermines the fundamental security assumptions of the filesystem's access control mechanisms, potentially allowing privilege escalation or data exposure scenarios that could affect system integrity and confidentiality.
This vulnerability aligns with CWE-284, which addresses improper access control in software systems, and demonstrates how filesystem-level implementation flaws can create persistent security weaknesses. The issue also maps to ATT&CK technique T1068, which involves local privilege escalation through system weaknesses, as local users can leverage this flaw to bypass intended file permissions. Organizations running affected VxFS implementations should prioritize applying the MP1 Rolling Patch 02 or equivalent updates to address this vulnerability. System administrators should also conduct thorough audits of their filesystem configurations to identify any potential exploitation vectors and consider implementing additional monitoring for unauthorized file access attempts. The vulnerability highlights the importance of proper filesystem security implementation and the need for comprehensive testing of access control mechanisms, particularly in enterprise environments where VxFS is commonly deployed for storage management and data protection.