SRT2003-06-13-1009.txt

Secure Network Operations, Inc. http://www.secnetops.com Strategic Reconnaissance Team [email protected] Team Lead Contact [email protected] Our Mission: Secure Network Operations offers expertise in Networking, Intrusion Detection Systems IDS, Software Security Validation, and...

SunOS versions of sendmail use popen to return undeliverable mail

Overview Older versions of sendmail circa 1995 incorrectly used popen to process certain arguments. Description There is a problem with the way that the older circa 1995 versions of Sun Microsystems, Inc. version of sendmail processes the -oR option. This problem has been verified as existing in...

Solaris TTYPROMPT Remote Login Bypass

Solaris TTYPROMPT Security Vulnerability Telnet This vulnerability is very simple to exploit, since it does not require any code to be compiled by an attacker. The vulnerability only requires the attacker to simply define the environment variable TTYPROMPT to a 6-character string, inside telnet...

CVE-1999-1080

rmmount in SunOS 5.7 may mount file systems without the nosuid flag set, contrary to the documentation and its use in previous versions of SunOS, which could allow local users with physical access to gain root privileges by mounting a floppy or CD-ROM that contains a setuid program and running...

CVE-1999-1080

In SunOS 5.7, rmmount may mount file systems without the nosuid flag, allowing local users with physical access to gain root privileges by mounting media containing a setuid program and running volcheck when nosuid is not specified in rmmount.conf. This vulnerability stems from mounting behavior ...

ypbind contains buffer overflow

Overview The daemon ypbind on Solaris and SunOS contains a buffer overflow vulnerability. Description A buffer overflow vulnerability has been discovered in ypbind, a daemon that runs on all client and server machines running Solaris and SunOS and set up to use a Network Information Server NIS. -...

CVE-1999-1258

rpc.pwdauthd in SunOS 4.1.1 and earlier does not properly prevent remote access to the daemon, which allows remote attackers to obtain sensitive system information...

CVE-1999-1258

CVE-1999-1258 affects SunOS 4.1.1 and earlier; the rpc.pwdauthd daemon does not properly prevent remote access, allowing remote attackers to obtain sensitive system information. The root cause is inadequate access control on the RPC daemon, leading to information disclosure. Public details in pro...

CVE-1999-1021

NFS on SunOS 4.1 through 4.1.2 ignores the high order 16 bits in a 32 bit UID, which allows a local user to gain root access if the lower 16 bits are set to 0, as fixed by the NFS jumbo patch upgrade...

CVE-1999-1507

Technical details for CVE-1999-1507 are not publicly available in the provided documents; monitor for updates.

CVE-2001-0699

Buffer overflow in cbreset in the System Service Processor SSP package of SunOS 5.8 allows a local user to execute arbitrary code via a long argument...

CVE-2001-0686

Buffer overflow in mail included with SunOS 5.8 for x86 allows a local user to gain privileges via a long HOME environment variable...

CVE-1999-1142

SunOS 4.1.2 and earlier allows local users to gain privileges via LD_* environment variables affecting dynamically linked setuid/setgid programs (e.g., login, su, sendmail) by causing real and effective UIDs to the same user. This yields a local escalation with complete confidentiality and integr...

CVE-1999-1142

SunOS 4.1.2 and earlier allows local users to gain privileges via "LD" environmental variables to certain dynamically linked setuid or setgid programs such as 1 login, 2 su, or 3 sendmail, that change the real and effective user ids to the same user...

CVE-1999-1402

Technical details about CVE-1999-1402 are not publicly available in the provided documents; monitor for updates.

CVE-1999-1318

/usr/5bin/su in SunOS 4.1.3 and earlier uses a search path that includes the current working directory ., which allows local users to gain privileges via Trojan horse programs...

CVE-1999-1137

CVE-1999-1137 concerns the /dev/audio device on Solaris 2.2 and earlier and SunOS 4.1.x. Permissions allow any local user to read the device, enabling potential eavesdropping on nearby conversations. Root cause: permissive read access to the audio device; affected components are the legacy Solari...

CVE-1999-1021

CVE-1999-1021 affects SunOS 4.1–4.1.2 NFS: the high-order 16 bits of a 32-bit UID are ignored, enabling a local user to gain root if the lower 16 bits are 0. The issue is mitigated/fixed by the NFS jumbo patch upgrade. The connected sources confirm the affected OS and the patch-based fix; exploit...

CVE-1999-1122

CVE-1999-1122 affects SunOS 4.0.3 and earlier, via a vulnerability in the restore component that enables local privilege escalation for local users. The connected PT-1989-1000 entry confirms the affected SunOS versions and notes that, at present, there is no information about a fix in newer versi...

CVE-1999-1297

cmdtool in OpenWindows 3.0 and XView 3.0 in SunOS 4.1.4 and earlier allows attackers with physical access to the system to display unechoed characters such as those from password prompts via the L2/AGAIN key...