CDE DTPrintInfo Home Environment Variable Buffer Overflow Vulnerability

Bugtraq ID:	9170
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 08 2003 12:00AM
Updated:	Dec 08 2003 12:00AM
Credit:	Vulnerability disclosed by Sun Microsystems.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6
Not Vulnerable:

CDE DTPrintInfo Home Environment Variable Buffer Overflow Vulnerability

A problem has been identified in the handling of strings in the environment by dtprintinfo. Because of this, it may be possible for a local attacker to execute arbitrary code on a vulnerable host.

CDE DTPrintInfo Home Environment Variable Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CDE DTPrintInfo Home Environment Variable Buffer Overflow Vulnerability

Solution:
Sun has released fixes for this issue.


Sun Solaris 2.6

• Sun 106437-04
  http://sunsolve.sun.com

Sun Solaris 7.0

• Sun 107885-09
  http://sunsolve.sun.com

Sun Solaris 8_x86

• Sun 110336-03
  http://sunsolve.sun.com

Sun Solaris 2.6_x86

• Sun 106438-04
  http://sunsolve.sun.com

Sun Solaris 8_sparc

• Sun 110335-03
  http://sunsolve.sun.com

Sun Solaris 9

• Sun 114495-01
  http://sunsolve.sun.com

Sun Solaris 9_x86

• Sun 114496-01
  http://sunsolve.sun.com

Sun Solaris 7.0_x86

• Sun 107886-09
  http://sunsolve.sun.com

CDE DTPrintInfo Home Environment Variable Buffer Overflow Vulnerability

References:

• Sun Alert ID: 57441 (Sun Microsystems)