solaris_bof.txt

Subject: Solaris 2.7 /usr/bin/mail To: [email protected] Greetings, There is a possible buffer overflow vulnerability in Solaris 2.7's sgid mail /usr/bin/mail. The reason it's only a possibility and not a full blow exploit is that mail drops sgid privs before the overflow occurs. However ...

Digital UNIX 4.0/4.0 B/4.0 D - SUID/SGID Core File

source: https://www.securityfocus.com/bid/74/info Digital UNIX 4.0 will follow symlinks while writting core files if two setuid programs dump core in sucession. The core file is owned by root but with the user's groud id. The core file permissions are 0600. This can be used to create root owned...

Solaris 7.0 - chkperm Local Privilege Escalation

Solaris 7.0 - chkperm Local Privilege Escalation source: https://www.securityfocus.com/bid/295/info Solaris 2.4, 2.5, and 2.5.1 possibly other versions have a package called FACE Framed Access Command Environment installed. Included in the package is a program called chkperm which checks a file t...

IRIX 5.26.0 - Permissions File Manipulation

IRIX 5.26.0 - Permissions File Manipulation source: https://www.securityfocus.com/bid/1751/info The IRIX's /usr/lib/desktop/permissions tool is a suid and sgid root applications normally used by users to modify permissions of their files and files they are privileged for. A vulnerability in the...