CVE-2006-4842
Summary
| CVE | CVE-2006-4842 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2006-10-12 00:07:00 UTC |
| Updated | 2018-10-17 21:39:00 UTC |
| Description | The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files. |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Netscape | Portable Runtime Api | 4.6.1 | All | All | All |
| Application | Netscape | Portable Runtime Api | 4.6.2 | All | All | All |
| Application | Netscape | Portable Runtime Api | 4.6.1 | All | All | All |
| Application | Netscape | Portable Runtime Api | 4.6.2 | All | All | All |
| Operating System | Sun | Solaris | 10.0 | All | sparc | All |
| Operating System | Sun | Solaris | 10.0 | All | sparc | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| Sun Solaris Netscape Portable Runtime API Local Privilege Escalation Vulnerability | BID | www.securityfocus.com | |
| #102658: Security Vulnerability in the Netscape Portable Runtime (NSPR) API Affects Solaris | SUNALERT | sunsolve.sun.com | |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| Solaris - libnspr NSPR_LOG_FILE Privilege Escalation (Metasploit) - Solaris local Exploit | EXPLOIT-DB | www.exploit-db.com | |
| Webmail - OVH | VUPEN | www.vupen.com | Vendor Advisory |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Public Advisory: 10.11.06 // iDefense Labs | IDEFENSE | labs.idefense.com | Vendor Advisory |
| Netscape Portable Runtime API Environment Variable Lets Local Users Create Arbitrary Files - SecurityTracker | SECTRACK | securitytracker.com | |
| Solaris Netscape Portable Runtime Privilege Escalation - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-01-11 | Mark J Cox | This issue also affects other OS that use NSPR. However, Red Hat does not ship any application linked setuid or setgid against NSPR and therefore is not vulnerable to this issue. |
There are currently no legacy QID mappings associated with this CVE.