 | ||||
| << Previous | INDEX | Search | src / Print | Next >> |
| ||||
| |||||||||||||||
From: SecuriTeam <support@securiteam.com.> To: list@securiteam.com Date: 12 Oct 2006 16:08:32 +0200 Subject: [UNIX] Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-Id: <20061012151438.893E357AF@mail.tyumen.ru.> X-Virus-Scanned: antivirus-gw at tyumen.ru The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html - - - - - - - - - Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability ------------------------------------------------------------------------ SUMMARY The <http://www.mozilla.org/projects/nspr/>; Netscape Portable Runtime (NSPR) API allows compliant applications to use system facilities such as threads, thread synchronization, I/O, interval timing, atomic operations and several other low-level services in a platform-independent manner. Local exploitation of a design error vulnerability in NSPR, as included with Sun Microsystems Solaris 10, allows attackers to create or overwrite arbitrary files on the system. DETAILS Vulnerable Systems: * Sun Microsystems Solaris 10 with NSPR version 4.6.1. The problem exists because environment variables are used to create log files. Even when the program is setuid, users can specify a log file that will be created with elevated privileges. Exploitation allows local attackers to elevate privileges to root. Vendor Status: Sun Microsystems has addressed this issue with <http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1>; Sun Security Alert 102658. CVE Information: <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4842>; CVE-2006-4842 Disclosure Timeline: * 08/31/2006 - Initial vendor notification * 09/04/2006 - Initial vendor response * 10/11/2006 - Coordinated public disclosure ADDITIONAL INFORMATION The information has been provided by iDefense. The original article can be found at: <http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418>; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418
This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
| |||||||||||||||
|
|
|
