Sun Solaris Netscape Portable Runtime API Local Privilege Escalation Vulnerability

Bugtraq ID:	20471
Class:	Design Error
CVE:	CVE-2006-4842
Remote:	No
Local:	Yes
Published:	Oct 11 2006 12:00AM
Updated:	Aug 25 2008 08:05PM
Credit:	iDefense has been credited with the discovery of this vulnerability.
Vulnerable:	Sun Solaris 10.0_x86 Sun Solaris 10.0 Netscape Portable Runtime API 4.6.1
Not Vulnerable:	Netscape Portable Runtime API 4.6.2

Sun Solaris Netscape Portable Runtime API Local Privilege Escalation Vulnerability

The Netscape Portable Runtime API running on Sun Solaris 10 operating system is prone to a local privilege-escalation vulnerability.

A successful exploit of this issue allows an attacker to gain superuser privileges, completely compromising the affected computer.

Version 4.6.1 running on Sun Solaris 10 is vulnerable to this issue.

Sun Solaris Netscape Portable Runtime API Local Privilege Escalation Vulnerability

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploits are available:

• /data/vulnerabilities/exploits/20471.sh
• /data/vulnerabilities/exploits/20471-ctors.sh

Sun Solaris Netscape Portable Runtime API Local Privilege Escalation Vulnerability

Solution:
Sun Microsystems has released an advisory to address this issue. Please see the references for more information.


Sun Solaris 10.0

• Sun 119213-10
  http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1

Sun Solaris 10.0_x86

• Sun 119214-10
  http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1

Sun Solaris Netscape Portable Runtime API Local Privilege Escalation Vulnerability

References:

• Netscape Portable Runtime API Home Page (Mozilla)
  
• Sun Solaris Home Page (Sun Microsystems)
  
• iDefense Security Advisory 10.11.06 (iDefense)