Solaris mailx -F Buffer Overflow Vulnerability

Bugtraq ID:	2610
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	May 02 2001 12:00AM
Updated:	May 02 2001 12:00AM
Credit:	This vulnerability was announced via Bugtraq by Pablo Sor <[email protected]> on May 2, 2001.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

Solaris mailx -F Buffer Overflow Vulnerability

Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.

A problem with the handling of a long string of characters by the -F option makes it possible for a local user to gain elevated privileges. Due to the insufficient handling of input by the -F option of mailx, a buffer overflow at 1150 characters makes it possible to overwrite variables on the stack, including the return address.

This problem makes it possible for a local user gain elevated privileges, attaining an effective GID of mail.

Solaris mailx -F Buffer Overflow Vulnerability

x

• /data/vulnerabilities/exploits/mailx-F.c
• /data/vulnerabilities/exploits/mailx-F.sparc.c