4.1 20051116211256 Sun Solaris 8 kcms_configure David Proulx kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument. CVE-2001-0594 ACCEPTED 1 Sun Solaris 8 libnsl David Proulx Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. CVE-2002-0391 ACCEPTED 1 Sun Solaris 8 xlock David Proulx Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable. CVE-2001-0652 ACCEPTED 1 Sun Solaris 8 snmpdx David Proulx Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges. CVE-2002-0796 ACCEPTED 1 Sun Solaris 8 Xsun David Proulx Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument. CVE-2002-0158 ACCEPTED 1 Sun Solaris 8 CDE David Proulx CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure. CVE-2002-0677 ACCEPTED 1 Sun Solaris 8 cachefsd David Proulx Brian Soby INTERIM ACCEPTED Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. CVE-2002-0033 ACCEPTED 3 Sun Solaris 7 Xsun David Proulx Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument. CVE-2002-0158 ACCEPTED 1 Sun Solaris 7 whodo David Proulx Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable. CVE-2001-1076 ACCEPTED 1 Sun Solaris 7 rpc.rwalld David Proulx Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed. CVE-2002-0573 ACCEPTED 1 Sun Solaris 7 libnsl David Proulx Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. CVE-2002-0391 ACCEPTED 1 Sun Solaris 7 cachefsd David Proulx Brian Soby INTERIM ACCEPTED Buffer overflow in the fscache_setup function of cachefsd in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long mount argument. CVE-2002-0084 ACCEPTED 2 Sun Solaris 8 whodo David Proulx Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable. CVE-2001-1076 ACCEPTED 1 Sun Solaris 7 admintool David Proulx Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path. CVE-2002-0088 ACCEPTED 1 Sun Solaris 8 rpc.yppasswdd David Proulx Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username. CVE-2001-0779 ACCEPTED 1 Sun Solaris 8 admintool David Proulx Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path. CVE-2002-0088 ACCEPTED 1 Sun Solaris 7 mibiisa David Proulx Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges. CVE-2002-0797 ACCEPTED 1 Sun Solaris 7 kcms_configure David Proulx kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument. CVE-2001-0594 ACCEPTED 1 Sun Solaris 8 admintool David Proulx Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file. CVE-2002-0089 ACCEPTED 1 Sun Solaris 7 admintool David Proulx Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file. CVE-2002-0089 ACCEPTED 1 Sun Solaris 8 dtspcd David Proulx Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands CVE-2001-0803 ACCEPTED 1 Sun Solaris 7 dtspcd David Proulx Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands CVE-2001-0803 ACCEPTED 1 Sun Solaris 8 rpc.rwalld David Proulx Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed. CVE-2002-0573 ACCEPTED 1 Sun Solaris 7 CDE David Proulx CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. CVE-2002-0678 ACCEPTED 1 Sun Solaris 8 lbxproxy David Proulx Buffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option. CVE-2002-0090 ACCEPTED 1 Sun Solaris 7 CDE David Proulx CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure. CVE-2002-0677 ACCEPTED 1 Sun Solaris 8 mibiisa David Proulx Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges. CVE-2002-0797 ACCEPTED 1 Sun Solaris 8 cachefsd David Proulx Brian Soby Brian Soby INTERIM ACCEPTED Buffer overflow in the fscache_setup function of cachefsd in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long mount argument. CVE-2002-0084 ACCEPTED 2 Sun Solaris 7 rpc.yppasswdd David Proulx Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username. CVE-2001-0779 ACCEPTED 1 Sun Solaris 7 snmpdx David Proulx Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges. CVE-2002-0796 ACCEPTED 1 Sun Solaris 7 kcms_server David Proulx Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. CVE-2003-0027 ACCEPTED 1 Sun Solaris 7 cachefsd David Proulx Brian Soby INTERIM ACCEPTED Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. CVE-2002-0033 ACCEPTED 2 Sun Solaris 7 xlock David Proulx Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable. CVE-2001-0652 ACCEPTED 1 Sun Solaris 8 fs.auto, xfs David Proulx Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. CVE-2002-1317 ACCEPTED 2 Sun Solaris 7 fs.auto, xfs David Proulx Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. CVE-2002-1317 ACCEPTED 2 Sun Solaris 8 CDE David Proulx CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. CVE-2002-0678 ACCEPTED 1 Sun Solaris 7 CDE David Proulx Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure. CVE-2002-0679 ACCEPTED 1 Sun Solaris 7 lbxproxy David Proulx Buffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option. CVE-2002-0090 ACCEPTED 1 Sun Solaris 8 CDE David Proulx Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure. CVE-2002-0679 ACCEPTED 1 Sun Solaris 8 kcms_server David Proulx Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. CVE-2003-0027 ACCEPTED 1 Sun Solaris 9 Bind Brian Soby DRAFT INTERIM ACCEPTED BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size. CVE-2002-1220 ACCEPTED 1 Sun Solaris 7 Xsun Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in Xsun in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable. CVE-2001-0422 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Licence Logging Service Brian Soby DRAFT INTERIM ACCEPTED Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code. CVE-2004-1351 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 snmpdx Brian Soby DRAFT INTERIM ACCEPTED Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. CVE-2002-0012 ACCEPTED 1 Sun Solaris 9 CDE Brian Soby DRAFT INTERIM ACCEPTED Brian Soby Brian Soby INTERIM ACCEPTED CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure. CVE-2002-0677 ACCEPTED 2 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Solaris Enterprise Authentication Mechanism (SEAM) Brian Soby DRAFT INTERIM ACCEPTED MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference. CVE-2003-0058 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 uucp Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM INTERIM ACCEPTED Multiple buffer overflows in uucp for Sun Solaris 2.6, 7, 8, and 9 allow local users to execute arbitrary code as the uucp user. CVE-2004-1359 ACCEPTED 2 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI. CVE-2004-0760 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sadmin Brian Soby Brian Soby DRAFT INTERIM ACCEPTED The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets. CVE-2003-0722 ACCEPTED 1 Sun Solaris 7 CDE Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Double-free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet. CVE-2004-0368 ACCEPTED 1 Sun Solaris 9 Samba Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string. CVE-2002-1318 ACCEPTED 1 Sun Solaris 7 libpng Brian Soby DRAFT INTERIM ACCEPTED Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image. CVE-2004-0599 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Solaris Management Console (SMC) Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM INTERIM ACCEPTED The Solaris Management Console (SMC) in Sun Solaris 8 and 9 generates different 404 error messages when a file does not exist versus when a file exists but is otherwise inacessible, which could allow remote attackers to obtain sensitive information in conjunction with a directory traversal (..) attack. CVE-2004-1354 ACCEPTED 2 Sun Solaris 8 tcsh Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM DRAFT INTERIM ACCEPTED Unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gain privileges. CVE-2003-1024 ACCEPTED 2 Sun Solaris 8 Licence Logging Service Brian Soby DRAFT INTERIM ACCEPTED gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files. CVE-2004-1349 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 sendfilev() Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED Unknown vulnerability in the sendfilev function in Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors. CVE-2004-1356 ACCEPTED 2 Sun Solaris 8 Sun Enterprise Storage Manager (ESM) Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 /usr/lib/print/conv_fix Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED Unknown vulnerability in conv_fix in Sun Solaris 7 through 9, when invoked by conv_lpd, allows local users to overwrite arbitrary files. CVE-2004-1360 ACCEPTED 2 Sun Solaris 7 NIS Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code. CVE-2001-1328 ACCEPTED 1 Sun Solaris 7 dtspcd Brian Soby DRAFT INTERIM ACCEPTED The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack. CVE-1999-0689 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 CDE Brian Soby DRAFT INTERIM ACCEPTED Heap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable. CVE-2003-0092 ACCEPTED 1 Sun Solaris 9 Solaris Management Console (SMC) Brian Soby DRAFT INTERIM ACCEPTED Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO. CVE-2003-0466 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Apache Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket." CVE-2004-0174 ACCEPTED 1 Sun Solaris 7 Solaris Enterprise Authentication Mechanism (SEAM) Brian Soby DRAFT Brian Soby INTERIM ACCEPTED Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. CVE-2004-0523 ACCEPTED 1 Sun Solaris 7 Bind Brian Soby DRAFT INTERIM ACCEPTED Brian Soby Brian Soby INTERIM ACCEPTED ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value. CVE-2003-0914 ACCEPTED 2 Sun Solaris 7 login Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin. CVE-2001-0797 ACCEPTED 1 Sun Solaris 9 pam_krb5 Brian Soby DRAFT Brian Soby INTERIM ACCEPTED Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files. CVE-2004-0653 ACCEPTED 1 Sun Solaris 7 Bind Brian Soby DRAFT INTERIM ACCEPTED BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference. CVE-2002-1221 ACCEPTED 1 Sun Solaris 9 Kerberos5 Brian Soby DRAFT Brian Soby INTERIM ACCEPTED The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding. CVE-2004-0644 ACCEPTED 1 Sun Solaris 9 Samba Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code. CVE-2003-0201 ACCEPTED 1 Sun Solaris 9 Sendmail Brian Soby DRAFT Brian Soby INTERIM ACCEPTED Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malicious DNS server. CVE-2002-0906 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sendmail Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c. CVE-2002-1337 ACCEPTED 1 Sun Solaris 7 libc Brian Soby DRAFT INTERIM ACCEPTED The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang). CVE-2002-1265 ACCEPTED 1 Sun Solaris 7 libpng Brian Soby DRAFT INTERIM ACCEPTED Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. CVE-2004-0597 ACCEPTED 1 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files. CVE-2004-0764 ACCEPTED 1 Sun Solaris 7 NIS Brian Soby DRAFT INTERIM ACCEPTED The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments. CVE-2002-1199 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Basic Security Module Brian Soby DRAFT Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic). CVE-2004-0654 DRAFT 0 Sun Solaris 8 Kerberos5 Brian Soby DRAFT INTERIM ACCEPTED The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun"). CVE-2003-0082 ACCEPTED 1 Vulnerability exists in standard Solaris kerberos and SEAM. This definition only covers Solaris kerberos Sun Solaris 7 Bind Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR). CVE-2002-1219 ACCEPTED 1 Sun Solaris 7 libpng Brian Soby DRAFT INTERIM ACCEPTED The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference. CVE-2004-0598 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Sun Cluster Brian Soby DRAFT INTERIM ACCEPTED Double-free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding. CVE-2003-0545 ACCEPTED 1 Sun Solaris 7 kcms_server Brian Soby DRAFT INTERIM ACCEPTED Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. CVE-2003-0027 ACCEPTED 1 Sun Solaris 8 Sun Crypto Accelerator 4000 Brian Soby DRAFT INTERIM ACCEPTED The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 ACCEPTED 1 Sun Solaris 7 Sun Am7990 Ethernet Driver Brian Soby DRAFT Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. CVE-2003-0001 DRAFT 0 Sun Solaris 9 OpenSSH Brian Soby DRAFT INTERIM ACCEPTED A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695. CVE-2003-0693 ACCEPTED 1 Sun Solaris 9 CDE Brian Soby DRAFT INTERIM ACCEPTED Brian Soby Brian Soby INTERIM ACCEPTED CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. CVE-2002-0678 ACCEPTED 2 Sun Solaris 9 fs.auto, xfs Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. CVE-2002-1317 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 TCP/IP Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED Unknown vulnerability in the TCP/IP stack for Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors. CVE-2004-1355 ACCEPTED 2 Sun Solaris 7 Sendmail Brian Soby DRAFT INTERIM ACCEPTED The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. CVE-2003-0694 ACCEPTED 1 Sun Solaris 7 CDE Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name. CVE-1999-0691 ACCEPTED 1 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid. CVE-2004-0758 ACCEPTED 1 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code. CVE-2004-0757 ACCEPTED 1 Sun Solaris 9 Kerberos5 Brian Soby DRAFT Brian Soby INTERIM ACCEPTED Double-free vulnerability in the krb5_rd_cred function for MIT Kerberos 5 (krb5) 1.3.1 and earlier may allow local users to execute arbitrary code. CVE-2004-0643 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Licence Logging Service Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code. CVE-2004-1352 ACCEPTED 1 Sun Solaris 9 Solaris Volume Manager (SVM) Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED The Sun Solaris Volume Manager (SVM) on Solaris 9 allows local users to cause a denial of service (kernel panic) via a malformed probe request to the SVM. CVE-2004-1346 ACCEPTED 2 Sun Solaris 9 sshd Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED The Secure Shell (SSH) Daemon (SSHD) in Sun Solaris 9 does not properly log IP addresses when SSHD is configured with the ListenAddress as 0.0.0.0, which makes it easier for remote attackers to hide the source of their activities. CVE-2004-1357 ACCEPTED 2 Sun Solaris 9 Basic Security Module Brian Soby DRAFT INTERIM ACCEPTED The patches (1) 114332-08 and (2) 114929-06 for Sun Solaris 9 disable the auditing functionality of the Basic Security Module (BSM), which allows attackers to avoid having their activity logged. CVE-2004-1358 ACCEPTED 1 Sun Solaris 7 Solaris Runtime Linker Brian Soby DRAFT INTERIM ACCEPTED Stack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable. CVE-2003-0609 ACCEPTED 1 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted. CVE-2004-0761 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sendmail Brian Soby DRAFT A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. CVE-2003-0681 DRAFT 0 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 priocntl() Brian Soby DRAFT INTERIM ACCEPTED Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module. CVE-2002-1296 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Apache Brian Soby DRAFT INTERIM ACCEPTED Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures. CVE-2003-0542 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 sendfilev() Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument. CVE-2001-0414 ACCEPTED 1 Sun Solaris 8 Bind Brian Soby DRAFT INTERIM ACCEPTED Unknown vulnerability in in.named on Solaris 8 allows remote attackers to cause a denial of service (process crash). CVE-2004-1348 ACCEPTED 1 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method. CVE-2004-0763 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 DtMail Brian Soby DRAFT INTERIM ACCEPTED Format string vulnerability in CDE Mailer (dtmail) on Solaris 8 and 9 allows local users to gain privileges via format strings in the argv[0] value. CVE-2004-0800 ACCEPTED 1 Sun Solaris 7 bash, tcsh, cash, sh, ksh Brian Soby DRAFT INTERIM ACCEPTED Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack. CVE-2000-1134 ACCEPTED 1 Sun Solaris 7 lpstat, libprint Brian Soby DRAFT INTERIM ACCEPTED Unknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files. CVE-2003-0999 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Apache Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. CVE-2003-0020 ACCEPTED 1 Sun Solaris 7 Bind Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers. CVE-2002-0651 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Sun Cluster Brian Soby DRAFT INTERIM ACCEPTED Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values. CVE-2003-0543 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 cachefsd Brian Soby DRAFT INTERIM ACCEPTED cachefsd in Solaris 2.6, 7, and 8 allows remote attackers to cause a denial of service (crash) via an invalid procedure call in an RPC request. CVE-2002-0085 ACCEPTED 1 Sun Solaris 7 CDE Brian Soby DRAFT INTERIM ACCEPTED Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges. CVE-1999-0693 ACCEPTED 1 Sun Solaris 7 lpstat Brian Soby DRAFT INTERIM ACCEPTED Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege. CVE-2003-0091 ACCEPTED 1 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box. CVE-2004-0762 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Apache Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret. CVE-2003-0987 ACCEPTED 1 Sun Solaris 7 Solaris Enterprise Authentication Mechanism (SEAM) Brian Soby DRAFT INTERIM ACCEPTED The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun"). CVE-2003-0082 ACCEPTED 1 Vulnerability exists in standard Solaris kerberos and SEAM. This definition only covers SEAM Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 kernel Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED Unknown vulnerability in Solaris 2.6 through 9 causes a denial of service (system panic) via "a rare race condition" or an attack by local users. CVE-2003-0669 ACCEPTED 2 Sun Solaris 8 Sun Solaris 9 Sun Cluster Brian Soby DRAFT INTERIM ACCEPTED OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used. CVE-2003-0544 ACCEPTED 1 Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code. CVE-2004-0722 ACCEPTED 1 Sun Solaris 9 Kerberos5 Brian Soby DRAFT INTERIM ACCEPTED Double-free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code. CVE-2004-0772 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 Apache Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions. CVE-2003-0993 ACCEPTED 1 Sun Solaris 7 Sun RPC Brian Soby DRAFT INTERIM ACCEPTED Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. CVE-2002-0391 ACCEPTED 1 Specific applications using this library are not tested for because Suns advisory only provides a sample of known vulnerable applications and states that they are still investigating. Sun Solaris 8 mozilla Brian Soby DRAFT INTERIM ACCEPTED The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability. CVE-2004-0718 ACCEPTED 1 Sun Solaris 8 Sun Solaris 9 LDAP Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED Unknown vulnerability in LDAP on Sun Solaris 8 and 9, when using Role Based Access Control (RBAC), allows local users to execute certain commands with additional privileges. CVE-2004-1353 ACCEPTED 2 Sun Solaris 8 Sun Solaris 9 Apache Brian Soby Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied. CVE-2004-0492 ACCEPTED 1 Sun Solaris 9 Kerberos5 Brian Soby DRAFT Brian Soby INTERIM ACCEPTED Double-free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier may allow remote attackers to execute arbitrary code. CVE-2004-0642 ACCEPTED 1 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 CDE Brian Soby DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary code via (1) a modified DTHELPUSERSEARCHPATH environment variable and the Help feature, (2) DTSEARCHPATH, or (3) LOGNAME. CVE-2003-0834 ACCEPTED 2 Sun Solaris 8 Sun Solaris 9 Apache Robert L. Hollis DRAFT INTERIM ACCEPTED mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret. CVE-2003-0987 ACCEPTED 5 Sun Solaris 8 Sun Solaris 9 Apache Robert L. Hollis DRAFT INTERIM ACCEPTED Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. CVE-2003-0020 ACCEPTED 5 Sun Solaris 8 Sun Solaris 9 Apache Robert L. Hollis DRAFT INTERIM ACCEPTED Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket." CVE-2004-0174 ACCEPTED 5 Sun Solaris 8 Sun Solaris 9 Apache Robert L. Hollis DRAFT INTERIM ACCEPTED mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions. CVE-2003-0993 ACCEPTED 5 Sun Solaris 8 Sun Solaris 9 Apache Robert L. Hollis DRAFT INTERIM ACCEPTED Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied. CVE-2004-0492 ACCEPTED 5 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 XDM Robert L. Hollis Christine Walzer DRAFT INTERIM ACCEPTED X Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request. CVE-2004-1347 ACCEPTED 5 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Robert L. Hollis DRAFT INTERIM ACCEPTED Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files. CVE-2004-0803 ACCEPTED 5 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Robert L. Hollis DRAFT INTERIM ACCEPTED Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452. CVE-2004-0804 ACCEPTED 5 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Robert L. Hollis DRAFT INTERIM ACCEPTED Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls. CVE-2004-0886 ACCEPTED 5 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Robert L. Hollis DRAFT INTERIM ACCEPTED Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow. CVE-2004-1308 ACCEPTED 5 119901 01 119900 01 SunOS 5.10 114220 11 SUNWTiffx SUNWTiff 114219 11 109932 10 109931 10 118954 02 118953 02 112786 27 112785 38 111845 03 111844 03 114145 04 113146 05 116974 02 ^i.*86 116973 02 [Ss][Pp][Aa][Rr][Cc] 116308 01 108949 08 107178 03 SUNWdthep /etc/nsswitch.conf ^[^#].*_attr.*ldap 112960 17 108993 38 11233 02 113319 01 108451 06 .*krb5kdc.* 112233 05 108528 19 106541 25 116462 01 110060 04 110057 07 112536 04 107115 12 107893 05 /etc/nsswitch.conf ^[^#]*hosts:.*dns 112970 02 109326 09 106938 06 113329 02 109320 07 107115 13 SUNWpsu SUNWpsr SUNWpcu SUNWpcr 109324 03 110898 02 110943 01 108416 02 108162 04 108574 03 SUNWdtdst 112810 06 109613 07 The presence of /etc/named.conf indicates that system system is probably configured as a DNS server /etc/named.conf 109326 16 /usr/lib/inet/xntpd 109667 04 109409 04 SUNWntpu 113146 03 112233 04 108528 18 110615 11 107684 11 egrep "^[Srecipient=2|S2]|^[^#]*\$>2|^[^#]*\$>recipient|^[^#]*\$>4|^[^#]*\$>final" /etc/mail/sendmail.cf True if any lines returned 112963 09 109147 07 106950 14 /etc/system ^[^\*]*set.*c2audit.* 114332 10 114332 08 /etc/ssh/sshd_config ^[^#]*ListenAddress.*0\.0\.0\.0 113273 05 SUNWsshdu /etc/vfstab ^/dev/md/ /etc/rc[2-4].d/S[0-9][0-9]svm.init SUNWlvmr 113073 13 116774 03 116986 02 118313 01 SUNWbip 108219 01 SUNWdtba[sx] 113575 05 110615 10 107684 10 117000 03 116895 01 113923 02 SUNWxwfs ^.*sshd.* 113273 04 hostname6?\.le.* 115172 01 112609 02 112604 02 SUNWkcl2r 114796 04 111400 02 107337 03 114636 01 SUNWkcsr[tx] ^/usr/apache/bin/httpd.*SUNWscvw/conf/httpd.conf.* SUNWscvw 115055 01 115054 01 113508 02 113505 02 112908 10 112921 02 112923 03 112925 03 112390 08 112237 09 SUNWkrbu - 32bit, SUNWkrbux - 64bit SUNWkrbux? SUNWkrbr egrep ^flags:.*a[sd] /etc/security/audit_control True if any lines returned grep c2audit /etc/system True if "set c2audit:audit_load = 1" or similiar 114332 12 109007 18 106541 33 ^.*ypxfrd.* 113579 01 109328 03 106541 24 Package which contains /usr/lib/netsvc/yp/ypxfrd SUNWypu .*rpcbind.* CVE-2002-1265 108764 01 CVE-2002-1265 108762 01 CVE-2002-1265 108760 01 CVE-2002-1265 108758 01 CVE-2002-1265 108756 01 CVE-2002-1265 108754 01 CVE-2002-1265 108551 03 CVE-2002-1265 107477 03 CVE-2002-1265 106942 09 CVE-2002-1265 106541 14 CVE-2002-1265 108752 01 CVE-2002-1265 108750 01 CVE-2002-1265 108748 01 .*sendmail .* 113575 03 110615 08 107684 08 SUNWsndmu 113575 01 SUNWsndmr ^.*smbd.* 114684 02 SUWNsmbar 112908 15 109326 10 106938 07 /etc/syslog.conf ^[^#]*(\*|daemon)\.debug /etc/pam.conf [^#]*pam_krb5.*debug 112908 12 112908 13 112085 02 112300 01 SUNWcsu = 32bit, SUNWcsxu = 64bit SUNWcsx?u 112970 06 109326 13 106938 08 /etc/krb5/krb5.conf ^[^#]auth_to_local.* 112390 09 112237 11 112536 05 112908 16 /etc/krb5/krb5.conf SUNWapchu .*httpd 113146 05 116973 01 /usr/sbin/in.ftpd 114564 02 SUNWftpu 114497 01 109354 19 107702 12 SUNWdtwm 108221 01 SUNWdtdmn ^.*ypbind.* 110322 01 108750 02 SUNWnisu 113329 05 109320 09 107115 14 SUNWpcu 117367 01 SUNWstm 112233 12 108528 27 112668 02 SUNWgzip 110943 02 Solaris Management Console web interface .*smcboot 116807 01 111313 02 SUNWwbmc SUNWnsb ^.*smbd.* 114684 01 SUNWsmbau 107180 31 112807 09 108919 21 ^.*dtlogin.* /usr/dt/bin/dtlogin /usr/sbin/sadmind -S 2 116454 01 116442 01 116457 02 /usr/sbin/sadmind SUNWadmfw 117767 02 117765 02 SUNWmozmail SUNWmoznav 113322 02 111570 03 106952 04 SUNWbnuu Rough translation of the Sun recommended test of: % grep default_realm /etc/krb5/krb5.conf | grep -v ___default_realm___ default_realm = EXAMPLE.COM /etc/krb5/krb5.conf ^[^#_]*default_realm[^=]*=[^_]*$ 112390 07 112237 07 112908 04 112536 02 SUNWkrggl SUNWkrgdo SUNWkr5sl SUNWkr5sv 112808 02 SUNWtltkx? 108869 15 107709 18 SUNWsasnm /usr/sbin/in.rwhod 117455 01 116984 01 118239 01 SUNWrcmds SUNWxwplt 108652 30 108376 25 /usr/sbin/in.named 112970 03 SUNWinamd 110286 10 107654 10 107893 20 108117 6 /usr/openwin/bin/xfs 1 /usr/openwin/bin/xfs 1 /usr/openwin/bin/xfs 1 /usr/openwin/lib/fs.auto 109862 3 /usr/openwin/bin/xfs /usr/openwin/lib/fs.auto 108376 30 /usr/openwin/bin/kcms_server 1 /usr/openwin/bin/kcms_server 1 /usr/openwin/bin/kcms_server 1 /usr/openwin/bin/kcms_server /usr/openwin/bin/kcms_server 111590 2 110896 02 /usr/openwin/bin/lbxproxy 1 /usr/openwin/bin/lbxproxy 1 108652 51 /usr/openwin/bin/lbxproxy 107893 19 112846 1 106934 4 /usr/dt/bin/dtspcd 1 /usr/dt/bin/dtspcd 1 /usr/dt/bin/dtspcd 1 /usr/dt/bin/dtspcd 108949 7 /usr/dt/bin/dtspcd 108721 2 110453 1 107337 2 ^.*mibiisa.* 107709 19 /usr/lib/snmp/mibiisa ^.*rpc\.yppasswdd.* 111596 2 /usr/lib/netsvc/rpc.yppasswdd ^.*/bin/admintool 1 ^.*/bin/admintool 1 ^.*/bin/admintool$ 111826 1 108800 02 108541 6 106942 22 /usr/lib/netsvc/rwall/rpc.rwalld 1 /usr/lib/netsvc/rwall/rpc.rwalld 1 /usr/lib/netsvc/rwall/rpc.rwalld 1 /usr/lib/netsvc/rwall/rpc.rwalld 112899 1 /usr/lib/netsvc/rwall/rpc.rwalld ^/usr/sbin/sparcv./whodo 1 ^/usr/sbin/sparcv./whodo 1 111600 1 ^/usr/sbin/sparcv./whodo$ 108376 38 SunOS 5.7 /usr/lib/fs/cachefs/cachefsd 1 /usr/lib/fs/cachefs/cachefsd 1 /usr/lib/fs/cachefs/cachefsd 1 /usr/lib/fs/cachefs/cachefsd 114008 01 SunOS 5.9 110896 2 /usr/lib/fs/cachefs/cachefsd /usr/dt/bin/rpc.ttdbserverd 1 /usr/dt/bin/rpc.ttdbserverd 1 /usr/dt/bin/rpc.ttdbserverd 1 /usr/dt/bin/rpc.ttdbserverd 110286 9 /usr/dt/bin/rpc.ttdbserverd /usr/openwin/bin/Xsun 1 /usr/openwin/bin/Xsun 1 108652 52 /usr/openwin/bin/Xsun ^.*snmpdx.* 108869 16 /usr/lib/snmp/snmpdx /usr/openwin/bin/xlock 1 /usr/openwin/bin/xlock 1 108652 38 /usr/openwin/bin/xlock ^.*dmispd.* /usr/dt/bin/rpc.cmsd 1 /usr/dt/bin/rpc.cmsd 1 /usr/dt/bin/rpc.cmsd 1 ^.*inetd.* root /usr/dt/bin/rpc.cmsd 108901 6 108827 30 /usr/lib/dmi/dmispd /usr/dt/bin/rpc.cmsd /usr/openwin/bin/kcms_configure 1 /usr/openwin/bin/kcms_configure 1 /usr/openwin/bin/kcms_configure 1 /usr/openwin/bin/kcms_configure SunOS 5.8