Sun Solaris 'crontab(1)' Unspecified Privilege Escalation Vulnerability
BID:29456
Info
Sun Solaris 'crontab(1)' Unspecified Privilege Escalation Vulnerability
| Bugtraq ID: | 29456 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 30 2008 12:00AM |
| Updated: | May 30 2008 12:00AM |
| Credit: | Charles Morris of Old Dominion University |
| Vulnerable: |
Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc Sun Solaris 10.0_x86 Sun Solaris 10.0 Sun OpenSolaris build snv_01 Sun OpenSolaris 0 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0 Avaya CMS Server 13.0 Avaya CMS Server 12.0 Avaya CMS Server 14.0 Avaya CMS Server 13.1 |
| Not Vulnerable: | |
Discussion
Sun Solaris 'crontab(1)' Unspecified Privilege Escalation Vulnerability
Sun Solaris is prone to an unspecified privilege-escalation vulnerability.
Successfully exploiting this issue allows local attackers to inject 'cron' jobs into another local user's 'crontab' file and possibly execute arbitrary code with elevated privileges. This may facilitate a complete compromise of affected computers; other attacks are also possible.
Currently very few technical details are available. We will update this BID as more information emerges.
This issue affects Sun Solaris 8, 9, and 10 for SPARC and x86 platforms. OpenSolaris based on builds snv_01 through snv_92 is also vulnerable.
Sun Solaris is prone to an unspecified privilege-escalation vulnerability.
Successfully exploiting this issue allows local attackers to inject 'cron' jobs into another local user's 'crontab' file and possibly execute arbitrary code with elevated privileges. This may facilitate a complete compromise of affected computers; other attacks are also possible.
Currently very few technical details are available. We will update this BID as more information emerges.
This issue affects Sun Solaris 8, 9, and 10 for SPARC and x86 platforms. OpenSolaris based on builds snv_01 through snv_92 is also vulnerable.
Exploit / POC
Sun Solaris 'crontab(1)' Unspecified Privilege Escalation Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Sun Solaris 'crontab(1)' Unspecified Privilege Escalation Vulnerability
Solution:
The vendor has released an advisory and fixes. Please see the references for more information.
Solution:
The vendor has released an advisory and fixes. Please see the references for more information.
References
Sun Solaris 'crontab(1)' Unspecified Privilege Escalation Vulnerability
References:
References:
- OpenSolaris Homepage (Oracle)
- Solaris Homepage (Sun Microsystems)
- ASA-2008-222 - A Security Vulnerability in the Solaris crontab(1) utility may al (Avaya)
- Solution 237864: A Security Vulnerability in the Solaris crontab(1) utility may (Sun Microsystems)