Solaris/SunOS man/catman Vulnerability

Bugtraq ID:	165
Class:	Environment Error
CVE:	CVE-1999-0370
Remote:	No
Local:	No
Published:	Feb 10 1999 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	Posted in a Sun Microsystems Security Bulletin on February 10, 1999.
Vulnerable:	Sun SunOS 4.1.4 Sun SunOS 4.1.3 _U1 Sun Solaris 2.5.1 _x86 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3
Not Vulnerable:

Solaris/SunOS man/catman Vulnerability

The man and catman utilities are used to display and create preformatted versions of the on-line manuals. Vulnerabilities in these commands have been discovered that may be exploited to arbitrary files when man or catman is executed with root privileges.

The following versions of Solaris are affected:

7, 7_x86, 2.6, 2.6_x86, 2.5.1, 2.5.1_x86, 2.5, 2.5_x86, 2.4, 2.4_x86, and 2.3

The following versions of SunOS are affected:

4.1.4 and 4.1.3_U1

Solaris/SunOS man/catman Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Solaris/SunOS man/catman Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 2.6

• Sun 106123-04
  sparc
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-106123-04-1

Sun Solaris 7.0

• Sun 107038-01
  sparc
  

Sun Solaris 2.4_x86

• Sun 106962-01
  x86
  

Sun Solaris 2.6_x86

• Sun 106124-04
  x86
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-106124-04-1

Sun Solaris 2.5

• Sun 106907-01
  sparc
  

Sun Solaris 7.0_x86

• Sun 107039-01
  x86
  

Sun Solaris 2.3

• Sun 106911-01
  sparc
  

Sun Solaris 2.4

• Sun 106912-01
  sparc
  

Sun Solaris 2.5.1 _x86

• Sun 106906-01
  x86
  

Sun SunOS 4.1.3 _U1

• Sun 107143-01
  sparc
  


• Sun 107156-01
  sparc
  

Sun SunOS 4.1.4

• Sun 107144-01
  sparc
  


• Sun 107157-01
  sparc
  

Solaris/SunOS man/catman Vulnerability

References: