From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 12 Oct 2006 16:08:32 +0200
Subject: [UNIX] Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20061012151438.893E357AF@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Sun Microsystems Solaris NSPR Library Arbitrary File Creation
Vulnerability
------------------------------------------------------------------------
SUMMARY
The <http://www.mozilla.org/projects/nspr/>; Netscape Portable Runtime
(NSPR) API allows compliant applications to use system facilities such as
threads, thread synchronization, I/O, interval timing, atomic operations
and several other low-level services in a platform-independent manner.
Local exploitation of a design error vulnerability in NSPR, as included
with Sun Microsystems Solaris 10, allows attackers to create or overwrite
arbitrary files on the system.
DETAILS
Vulnerable Systems:
* Sun Microsystems Solaris 10 with NSPR version 4.6.1.
The problem exists because environment variables are used to create log
files. Even when the program is setuid, users can specify a log file that
will be created with elevated privileges.
Exploitation allows local attackers to elevate privileges to root.
Vendor Status:
Sun Microsystems has addressed this issue with
<http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1>; Sun
Security Alert 102658.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4842>;
CVE-2006-4842
Disclosure Timeline:
* 08/31/2006 - Initial vendor notification
* 09/04/2006 - Initial vendor response
* 10/11/2006 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418>;
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
