CVE-1999-0273

Denial of service through Solaris 2.5.1 telnet by sending ^D characters...

CVE-1999-0263

Solaris SUNWadmap can be exploited to obtain root access...

Solaris 7.0 - Recursive mutex_enter Remote Panic (Denial of Service)

Solaris 7.0 - Recursive mutexenter Remote Panic Denial of Service source: https://www.securityfocus.com/bid/655/info A vulnerability in Solaris TCP/IP stack may allow remote users to panic the system. If the nmap network mapping utility is used with the OS fingerprinting option '-O' against an...

solaris.2.5.su.expect.txt

Date: Thu, 10 Jun 1999 14:13:06 -0500 From: Dr. Mudge To: [email protected] Subject: Solaris 2.5 /bin/su was: vulnerability in su/PAM in redhat The same sort of problem existed in solaris /bin/su on 2.5 and below. The comments in the quick proof of concept sploit below should explain further h...

CVE-1999-0676

sdtcmconvert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack...

IBM AIX 4.2.1 Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (1)

IBM AIX 4.2.1 Sun Solaris 7.0 - LCMESSAGES libc Buffer Overflow 1 source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges...

CVE-1999-0806

Buffer overflow in Solaris dtprintinfo program...

CVE-1999-0442

Solaris ff.core allows local users to modify files...

Sun Solaris 7.0 - 'ff.core' Local Privilege Escalation

source: https://www.securityfocus.com/bid/327/info There is a vulnerability in Solaris's ff.core utility which allows normal users to execute the rename command as root. This particular bug when leveraged against a series of other configuration issues in a standard Solaris setup can lead to a roo...

Sun Solaris 7.0 - ff.core Local Privilege Escalation

Sun Solaris 7.0 - ff.core Local Privilege Escalation source: https://www.securityfocus.com/bid/327/info There is a vulnerability in Solaris's ff.core utility which allows normal users to execute the rename command as root. This particular bug when leveraged against a series of other configuration...

Solaris 2.5.1 - kcms Local Buffer Overflow (1)

Solaris 2.5.1 - kcms Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possibl...

Solaris 2.5.1 - 'kcms' Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possible for an attacker to overflow the buffer and...

Solaris 2.5.1 - kcms Local Buffer Overflow (2)

Solaris 2.5.1 - kcms Local Buffer Overflow 2 / source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possible...

CVE-1999-0188

The passwd command in Solaris can be subjected to a denial of service...

CVE-1999-0139

Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access...

CVE-1999-1432

Power management Powermanagement on Solaris 2.4 through 2.6 does not start the xlock process until after the sys-suspend has completed, which allows an attacker with physical access to input characters to the last active application from the keyboard for a short period after the system is...

CVE-1999-0069

Solaris ufsrestore buffer overflow...

CVE-1999-0296

Solaris volrmmount program allows attackers to read any file...

CVE-1999-1428

Solaris Solstice AdminSuite AdminSuite 2.1 and 2.2 allows local users to gain privileges via the save option in the Database Manager, which is running with setgid bin privileges...

Sun Solaris 2.5.1 PAM / unix_scheme - 'passwd' Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/201/info There is a buffer overflow condition on arguments in Pluggable Authentication Modules PAM and unixscheme 5.4 and 5.3. Therefore, an unauthorized user could exploit this vulnerability via the passwd program to gain root access. Under SunOS 5.5.1...