Sun Solaris XSun Color Database File Heap Overflow Vulnerability

Bugtraq ID:	4408
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 02 2002 12:00AM
Updated:	Apr 02 2002 12:00AM
Credit:	This vulnerability discovery credited to NSFOCUS Security Team <[email protected]>.
Vulnerable:	Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

Sun Solaris XSun Color Database File Heap Overflow Vulnerability

Solaris is the freely available Unix operating system distributed by Sun Microsystems.

It may be possible for a local user to gain elevated privileges. When Xsun is executed, and an excessively long argument is supplied to the -co flag, a heap overflow occurs. This problem could allow a local user to supply a maliciously formatted string with the -co option that could result in the execution of arbitrary code, and elevated privileges.

Sun Solaris XSun Color Database File Heap Overflow Vulnerability

An exploit has been developed by gloomy <[email protected]> and eSDee <[email protected]>.

• /data/vulnerabilities/exploits/Xsun-expl.c

Sun Solaris XSun Color Database File Heap Overflow Vulnerability

Solution:
Patches available:


Sun Solaris 7.0_x86

• Sun 108377-34
  http://sunsolve.sun.com

Sun Solaris 2.6

• Sun 105633-61
  http://sunsolve.sun.com

Sun Solaris 7.0

• Sun 108376-38
  http://sunsolve.sun.com

Sun Solaris 8_x86

• Sun 108653-43
  http://sunsolve.sun.com

Sun Solaris 2.6_x86

• Sun 106248-46
  http://sunsolve.sun.com

Sun Solaris 8_sparc

• Sun 108652-53
  http://sunsolve.sun.com

Sun Solaris XSun Color Database File Heap Overflow Vulnerability

References: