Sun RPC XDR xdrmem_getbytes Function Remote Overflow

The RPC library has an integer overflow in the function xdrmemgetbytes. An attacker may use this flaw to execute arbitrary code on this host with the privileges your RPC programs are running with typically root, by sending a specially crafted request to them. Note that this issue affects Solaris,...

CVE-2003-1079

Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC, and 2.5.1 through 8 for x86, allows remote attackers to cause a denial of service memory consumption via certain arguments in RPC calls that cause large amounts of memory to be allocated...

Sun Solaris lockd(1M) daemon vulnerable to DoS

Overview A remotely exploitable denial-of-service vulnerability exists in the Solaris lockd1M daemon. Exploitation of this vulnerability may kill the lockd process. Description Sun Microsystems describes the lockd1M daemon as follows:The lockd utility is part of the NFS lock manager, which suppor...

Sun Solaris AUTH_DES authentication contains vulnerability allowing user to gain escalated privileges

Overview A remotely exploitable privilege escalation vulnerability exists in multiple versions of Solaris. Description RPC requests utilizing AUTHDES authentication can trigger a privilege escalation vulnerability in multiple versions of Solaris. For more details, please see Sun Alert ID 46944. -...

CVE-2003-1071

rpc.walld wall daemon for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header...

CVE-2002-1296

Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pcclname field of a pcinfot structure, which cause priocntl to load a malicious kernel module...

CVE-2002-1586

Solaris 2.5.1 through 9 allows local users to cause a denial of service kernel panic by setting the sdstruiowrq variable in the struioget function to null, which triggers a null dereference...

ISS Security Brief: Solaris fs.auto Remote Compromise Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- ISS X-Force Security Brief November 25, 2002 Solaris fs.auto Remote Compromise Vulnerability Synopsis: ISS X-Force has discovered a vulnerability in the Sun Microsystems implementation of the "X Window Font Service", or "XFS". The XFS service was designed as a...

CVE-2002-1585

Unknown vulnerability in Solaris 8 for Intel and Solaris 8 and 9 for SPARC allows remote attackers to cause a denial of service via certain packets that cause some network interfaces to stop responding to TCP traffic...

Solaris 2.678 - TTYPROMPT in.telnet Remote Authentication Bypass

Solaris 2.678 - TTYPROMPT in.telnet Remote Authentication Bypass Solaris TTYPROMPT Security Vulnerability Telnet This vulnerability is very simple to exploit, since it does not require any code to be compiled by an attacker. The vulnerability only requires the attacker to simply define the...

Solaris 2.6/7/8 (TTYPROMPT in.telnet) Remote Authentication Bypass

Exploit for solaris platform in category remote exploits ================================================================== Solaris 2.6/7/8 TTYPROMPT in.telnet Remote Authentication Bypass ================================================================== Solaris TTYPROMPT Security Vulnerability...

Solaris 2.6, 7, 8

Hello, Solaris 2.6, 7, and 8 /bin/login has a vulnerability involving the environment variable TTYPROMPT. This vulnerability has already been reported to BugTraq and a patch has been released by Sun. However, a very simple exploit, which does not require any code to be compiled by an attacker,...

solaris.login.txt

Hello, Solaris 2.6, 7, and 8 /bin/login has a vulnerability involving the environment variable TTYPROMPT. This vulnerability has already been reported to BugTraq and a patch has been released by Sun. However, a very simple exploit, which does not require any code to be compiled by an attacker,...

Immunity Canvas: TTDB_XDRARRAY

Name| ttdbxdrarray ---|--- CVE| CVE-2002-0391 Exploit Pack| CANVAS Description| rpc.ttdbserverd xdrarray Heap Overflow Notes| References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F46122 CVE Name: CVE-2002-0391 VENDOR: Sun Patch Info: Solaris 2.5.1: 103640-42, Solaris 2.6: 105401-3...

CVE-2002-0573

Format string vulnerability in RPC wall daemon rpc.rwalld for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed...

[LSD] Solaris cachefsd remote buffer overflow vulnerability

Solaris cachefsd remote buffer overflow vulnerability We would like to report another security vulnerability in the Solaris cachefsd program, which allows remote root access to the vulnerable system. The following information has been sent to Sun Microsystems some time ago, yet we have not receiv...

Solaris rpc.rwalld Remote Format String Arbitrary Code Execution

The rpc.walld RPC service is running. Some versions of this server allow an attacker to gain root access remotely, by consuming the resources of the remote host then sending a specially formed packet with format strings to this host. Solaris 2.5.1, 2.6, 7, 8 and 9 are vulnerable to this issue...

Solaris /bin/login Vulnerability

...

CVE-2002-0085

cachefsd in Solaris 2.6, 7, and 8 allows remote attackers to cause a denial of service crash via an invalid procedure call in an RPC request...

CVE-1999-1432

Power management Powermanagement on Solaris 2.4 through 2.6 does not start the xlock process until after the sys-suspend has completed, which allows an attacker with physical access to input characters to the last active application from the keyboard for a short period after the system is...