CVE-2005-3674

The Internet Key Exchange version 1 IKEv1 implementation in the libike library in Sun Solaris 9 and 10 allows remote attackers to cause a denial of service in.iked crash via certain crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in...

CVE-2005-3398

CVE-2005-3398 relates to the Solaris Management Console web server in Solaris 8/9/10 where the HTTP TRACE method is enabled by default. The effect is potential cross-site tracing information leakage (e.g., cookies or headers) through TRACE requests. Connected docs confirm the TRACE issue as a rec...

Solaris 9 (x86) : 118559-39

SunOS 5.9x86: Kernel Patch. Date this patch was last updated by Sun : Jan/17/07 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 9 (x86) : 119212-36

NSSNSPRJSS 3.30.2x86: NSPR 4.15 / NSS 3.30.2 / JSS 4.3.2. Date this patch was last updated by Sun : Nov/09/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

[SA16955] Sun Solaris Xsun and Xprt Privilege Escalation Vulnerability

TITLE: Sun Solaris Xsun and Xprt Privilege Escalation Vulnerability SECUNIA ADVISORY ID: SA16955 VERIFY ADVISORY: http://secunia.com/advisories/16955/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system OPERATING SYSTEM: Sun Solaris 9 http://secunia.com/product/95/ Sun Solari...

Solaris 9 (sparc) : 120464-03

SunOS 5.9: ifconfig, in.routed, ipmp patch. Date this patch was last updated by Sun : Dec/13/05 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Solaris 9 (x86) : 119902-01

Openwindows 3.7.0x86: Xview Patch. Date this patch was last updated by Sun : Aug/02/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 9 (sparc) : 112811-02

OpenWindows 3.7.0: Xview Patch. Date this patch was last updated by Sun : Aug/02/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 9 (sparc) : 118666-86

JavaSE 5.0: update 85 patch equivalent to JDK 5.0u85. Date this patch was last updated by Sun : Apr/13/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

CVE-2002-2089

Buffer overflow in rcp in Solaris 9.0 allows local users to execute arbitrary code via a long command line argument...

Solaris 9 (x86) : 119450-02

SunOS 5.9x86: Perl Patch. Date this patch was last updated by Sun : Mar/31/11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris 9 (sparc) : 119449-02

SunOS 5.9: Perl Patch. Date this patch was last updated by Sun : Mar/31/11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid1860...

ldsoWhoops.txt

ld.so from Solaris 9 and 10 doesn't check LDAUDIT environment variable when running sugid binaries, allowing to run arbitrary code with elevated privileges. Well, I can't belive, that such trivial vulnerability exists in modern OS... The following PoC code was tested on: - SunOS 5.10 Generic i86p...

Solaris 9 / 10 ld.so Local Root Exploit (2)

Exploit for solaris platform in category local exploits =========================================== Solaris 9 / 10 ld.so Local Root Exploit 2 =========================================== / Solaris 9 on SPARC: $ cat dupa.c / char sh = / setuid / "\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" /...

Solaris 910 - ld.so Local Privilege Escalation (2)

Solaris 910 - ld.so Local Privilege Escalation 2 / Solaris 9 on SPARC: $ cat dupa.c / char sh = / setuid / "\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" / execve / "\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20"...

Solaris 9/10 - 'ld.so' Local Privilege Escalation (2)

/ Solaris 9 on SPARC: $ cat dupa.c / char sh = / setuid / "\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" / execve / "\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20" "\x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14" "\x82\x10\x20\x0b\x91\xd0\x20\x08/bin/ksh";...

Solaris 9 / 10 ld.so Local Root Exploit (1)

Exploit for solaris platform in category local exploits =========================================== Solaris 9 / 10 ld.so Local Root Exploit 1 =========================================== / - SunOS 5.10 Generic i86pc i386 i86pc - SunOS 5.9 Generic112233-12 sun4u It does NOT work on: SunOS 5.8...

Solaris 10 /usr/sbin/traceroute vulnerabilities

/usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in handling -g argument. After supplying 10 -g parameters, return address is overwritten by IP address argument: atari:root:/home/venglin /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8 -g 9 -g 10 127.0.0.1...

Solaris 9 (sparc) : 117485-01

SunOS 5.9: fnctxx500.so.1 Patch. Date this patch was last updated by Sun : May/04/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2005-1518

Unknown vulnerability in Solaris 7 through 9, when using Federated Naming Services FNS, autofs, and FNS X.500 configuration, allows local users to cause a denial of service automountd crash when "accessing" /xfn/x500...