Solaris dtprintinfo Buffer Overflow Vulnerability

Bugtraq ID:	249
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	May 10 1999 12:00AM
Updated:	May 10 1999 12:00AM
Credit:	This vulnerability was published in the BUGTRAQ mailing list by UNYUN@ShadowPenguin <[email protected]>.
Vulnerable:	Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:	HP HP-UX 11.0 Digital UNIX 4.0 D Digital UNIX 4.0 C Digital UNIX 4.0 B Digital UNIX 4.0 A Digital UNIX 4.0

Solaris dtprintinfo Buffer Overflow Vulnerability

Before executing the ex_dtprintinfo exploit set your DISPLAY environment variable correctly, and make a dummy lpstat command like:

% cat > lpstat
echo "system for lpprn: server.com"
^D
% chmod 755 lpstat
% setenv PATH .:$PATH
% gcc ex_dtprintinfo.c
% a.out

• /data/vulnerabilities/exploits/ex_dtprintinfo.c

Solaris dtprintinfo Buffer Overflow Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 7.0_x86

• Sun 107220-02
  x86
  

Sun Solaris 2.6

• Sun 106437-03
  sparc
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-106437-03-1

Sun Solaris 7.0

• Sun 107219-02
  sparc
  

Sun Solaris 2.6_x86

• Sun 106438-03
  x86
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-106438-03-1

Solaris dtprintinfo Buffer Overflow Vulnerability

References: