Solaris xlock Heap Overflow Vulnerability

Bugtraq ID:	3160
Class:	Boundary Condition Error
CVE:	CVE-2001-0652
Remote:	No
Local:	Yes
Published:	Aug 09 2001 12:00AM
Updated:	Jan 31 2019 02:00AM
Credit:	Discovered by Nsfocus Security Team <[email protected]>.
Vulnerable:	Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

Solaris xlock Heap Overflow Vulnerability

Xlock is a utility for locking X-windows displays. It is installed setuid root because it uses the user's password to authorize access to the display when it is locked.

The version of xlock that ships with Solaris as part of OpenWindows contains a heap overflow in it's handling of an environment variable.

Local attackers may be able to execute arbitrary code with effective privileges of xlock.

Solaris xlock Heap Overflow Vulnerability

Exploits for Sparc and Intel versions of Solaris are available.

• /data/vulnerabilities/exploits/sol_sparc_xlockex.c
• /data/vulnerabilities/exploits/sol_x86_xlockex.c
• /data/vulnerabilities/exploits/sol_sparc_xlockex.c
• /data/vulnerabilities/exploits/sol_x86_xlockex.c

Solaris xlock Heap Overflow Vulnerability

Solution:
Sun has provided the patch IDs that the forthcoming fixes have been assigned. This record will be updated when the fixes are actually available for download.


Sun Solaris 7.0_x86

• Sun 108377-26
  

Sun Solaris 2.6

• Sun 105633-60
  

Sun Solaris 7.0

• Sun 108376-30
  

Sun Solaris 8_x86

• Sun 108653-33
  

Sun Solaris 2.6_x86

• Sun 106248-45
  

Sun Solaris 8_sparc

• Sun 108652-38
  

Solaris xlock Heap Overflow Vulnerability

References:

• Sunsolve Online(tm) (Sun Microsystems)