Sun CDE DtSvc DTDataBaseSearchPath Buffer Overflow Vulnerability

Bugtraq ID:	13758
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 06 2005 12:00AM
Updated:	Jan 06 2005 12:00AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Sun SunOS 5.9 _x86 Sun SunOS 5.9 Sun Solaris 9_x86 Sun Solaris 9
Not Vulnerable:

Sun CDE DtSvc DTDataBaseSearchPath Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in Sun CDE DtSvc library that is included with SunOS 5.9 and Solaris 9. The issue manifests when 'DTDATABASESEARCHPATH' data is handled. Few details are known in regard to this issue.

This issue may be exploited by local users to gain superuser privileges.

This BID will be updated as soon as further information is made available.

Sun CDE DtSvc DTDataBaseSearchPath Buffer Overflow Vulnerability

Charles Stevenson has provided an exploit for this issue:

• /data/vulnerabilities/exploits/DtSvc_exp.pl

Sun CDE DtSvc DTDataBaseSearchPath Buffer Overflow Vulnerability

Solution:
The vendor has released a patch to address the issue:


Sun SunOS 5.9

• Sun 113798-02
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=113798-02&method=f

Sun SunOS 5.9 _x86

• Sun 113838-02
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=113838-02&method=f

Sun CDE DtSvc DTDataBaseSearchPath Buffer Overflow Vulnerability

References:

• 113798-02 - CDE 1.5: libDtSvc patch (Sun)