Sun Solaris 7 XSun Color Database File Heap Overflow

The OVAL Repository 5.6 2009-11-20T04:32:19.777-05:00 Sun Solaris 7 XSun Color Database File Heap Overflow Sun Solaris 7 Xsun Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument. David Proulx ACCEPTED Solaris 7 mibiisa Remote Buffer Overflow Vulnerability Sun Solaris 7 mibiisa Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges. David Proulx ACCEPTED Solaris 7 kcms_configure Command-Line Buffer Overflow Sun Solaris 7 kcms_configure kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument. David Proulx ACCEPTED Solaris 7 rpc.yppasswdd Buffer Overrun Vulnerability Sun Solaris 7 rpc.yppasswdd Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username. David Proulx ACCEPTED String Format Vulnerability in Solaris 7 snmpdx Sun Solaris 7 snmpdx Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges. David Proulx ACCEPTED Heap Overflow in Solaris 7 xlock Sun Solaris 7 xlock Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable. David Proulx ACCEPTED Solaris 7 LBXProxy Display Name Buffer Overflow Sun Solaris 7 lbxproxy Buffer overflow in Low BandWidth X proxy (lbxproxy) in Solaris 8 allows local users to execute arbitrary code via a long display command line option. David Proulx ACCEPTED Xsun Buffer Overflow via HOME Envvar Sun Solaris 7 Xsun Buffer overflow in Xsun in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED SNMP Trap Handling Vulnerability Sun Solaris 7 Sun Solaris 8 snmpdx Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Integer Overflow in libpng via Malformed PNG Image Sun Solaris 7 libpng Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED ypbind Daemon Buffer Overflow Sun Solaris 7 NIS Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED CDE dtspcd Daemon Symlink Vulnerability Sun Solaris 7 dtspcd The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED dtsession Buffer Overflow via HOME Envvar Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Common Desktop Environment Heap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED BIND DoS via SIG RR Elements Sun Solaris 7 Bind BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Multiple Buffer Overflows in libpng Sun Solaris 7 libpng Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED ypxfrd File Disclosure Vulnerability Sun Solaris 7 NIS The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a directory traversal and symlink attack on the domain and map arguments. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED BIND SIG Resource Records Buffer Overflow Sun Solaris 7 Bind Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR). Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED DoS Vulnerability in libpng function png_handle_iCCP() Sun Solaris 7 libpng The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Sendmail prescan function Buffer Overflow Sun Solaris 7 Sendmail The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED CDE AddSuLog Function Buffer Overflow Sun Solaris 7 Common Desktop Environment Buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Runtime linker, ld.so.1 LD_PRELOAD Envvar Buffer Overflow Sun Solaris 7 Solaris Runtime Linker Stack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED priocntl Directory Traversal Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 priocntl() Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Multiple Vulnerabilities in lpstat and libprint Sun Solaris 7 lpstat, libprint Unknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Buffer Overflow in DNS Resolver Library Sun Solaris 7 Bind Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED ToolTalk Buffer Overflow via TT_SESSION Envvar Sun Solaris 7 Common Desktop Environment Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED lpq Buffer Overflow in bsd_queue() Sun Solaris 7 lpstat Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED rwho daemon Code Execution Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Licence Logging Service Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Sendmail Address Processor Buffer Overflow Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sendmail Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Sun RPC No Timeout Denial of Service on TCP Ports Sun Solaris 7 libc The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang). Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Buffer Overflow in Solaris ping Daemon Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Licence Logging Service Buffer overflow in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Buffer Overflow in ntp Daemon via readvar Sun Solaris 7 Sun Solaris 8 sendfilev() Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Multiple Buffer Overflows in Kerberos 5 (krb5_aname_to_localname) Sun Solaris 7 Solaris Enterprise Authentication Mechanism (SEAM) Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. Brian Soby DRAFT Brian Soby INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Kerberos 5 KDC Buffer Underrun in Principle Name Handling Sun Solaris 7 Solaris Enterprise Authentication Mechanism (SEAM) The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun"). Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Vulnerability exists in standard Solaris kerberos and SEAM. This definition only covers SEAM SunRPC xdr_array Function Integer Overflow Sun Solaris 7 Sun RPC Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Specific applications using this library are not tested for because Suns advisory only provides a sample of known vulnerable applications and states that they are still investigating. Shell Redirect Symlink Attack Vulnerability Sun Solaris 7 Sun Solaris 8 Bourne Shell (sh) Bourne Again Shell (bash) TENEX C Shell (tcsh) C Shell (csh) Korn Shell (ksh) Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM Matthew Wojcik ACCEPTED ACCEPTED System V login Buffer Overflow Sun Solaris 7 login Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Kerberos V5 Null Pointer DoS Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Solaris Enterprise Authentication Mechanism (SEAM) MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED PC Netlink 2.0 Privilege Escalation Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Solaris Management Console The (1) slsmgr and (2) slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, which allows local users to gain privileges. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED libtiff Directory Entry Count Integer Overflow Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED libtiff Malloc Error Denial of Service Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED libtiff tif_dirread divide-by-zero Denial of Service Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED libtiff RLE Decoder Buffer Overflow Vulnerabilities Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 libtiff Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files. Robert L. Hollis DRAFT INTERIM ACCEPTED ACCEPTED X Display Manager DoS via Invalid XDMCP Request Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 XDM X Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request. Robert L. Hollis Christine Walzer DRAFT INTERIM ACCEPTED ACCEPTED Solaris Code Execution DoS Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 kernel Unknown vulnerability in Solaris 2.6 through 9 causes a denial of service (system panic) via "a rare race condition" or an attack by local users. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED Solaris 7 admintool Local Buffer Overflow Sun Solaris 7 Admintool Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file. David Proulx Matthew Wojcik Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED Buffer Overflows in uucp Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 uucp Multiple buffer overflows in uucp for Sun Solaris 2.6, 7, 8, and 9 allow local users to execute arbitrary code as the uucp user. Brian Soby DRAFT INTERIM ACCEPTED Matthew Wojcik INTERIM INTERIM ACCEPTED ACCEPTED Solaris Xsun and Xprt Unspecified Local Privilege Escalation Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Xsun Unspecified vulnerability in the (1) Xsun and (2) Xprt commands in Solaris 7, 8, 9, and 10 allows local users to execute arbitrary code. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED ISC BIND Cache Poison Denial Of Service Sun Solaris 7 Bind ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value. Brian Soby DRAFT INTERIM ACCEPTED Brian Soby Brian Soby INTERIM ACCEPTED ACCEPTED Solaris 7 AdminTool Media Installation Path Buffer Overflow Sun Solaris 7 Admintool Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path. David Proulx Matthew Wojcik Matthew Wojcik Matthew Wojcik INTERIM ACCEPTED Matthew Wojcik INTERIM ACCEPTED ACCEPTED /usr/lib/print/conv_fix Privilege Escalation Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Unknown vulnerability in conv_fix in Sun Solaris 7 through 9, when invoked by conv_lpd, allows local users to overwrite arbitrary files. Brian Soby DRAFT INTERIM ACCEPTED INTERIM DRAFT INTERIM ACCEPTED ACCEPTED MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Name Buffer Overrun Vulnerabilities Sun Solaris 9 Sun Solaris 8 Sun Solaris 7 Operating System Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED MIT Kerberos 5 Key Distribution Center Remote Denial of Service Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Kerberos Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (apllication crash) and possibly execute arbitrary code via a certain valid TCP or UDP request. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED MIT Kerberos 5 Key Distribution Center Remote Denial of Service Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Kerberos MIT Kerberos 5 (krb5) 1.3 through 1.4.1 Key Distribution Center (KDC) allows remote attackers to cause a denial of service (application crash) via a certain valid TCP connection that causes a free of unallocated memory. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED ACCEPTED CDE libDtHelp Buffer Overflow Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Common Desktop Environment Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary code via (1) a modified DTHELPUSERSEARCHPATH environment variable and the Help feature, (2) DTSEARCHPATH, or (3) LOGNAME. Brian Soby DRAFT INTERIM ACCEPTED Christine Walzer INTERIM ACCEPTED ACCEPTED Solaris 7 whodo Buffer Overflow Vulnerability Sun Solaris 7 whodo Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable. David Proulx Matthew Wojcik INTERIM Matthew Wojcik Matthew Wojcik Matthew Wojcik ACCEPTED ACCEPTED Data Leak in NIC Sun Solaris 7 Sun Am7990 Ethernet Driver Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. Brian Soby DRAFT Matthew Wojcik DRAFT Sendmail Ruleset Parsing Buffer Overflow Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sendmail A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. Brian Soby DRAFT DRAFT Solaris 7 RPC xdr_array Buffer Overflow Sun Solaris 7 libnsl Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. David Proulx Matthew Wojcik INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris 7 RWall Daemon Syslog Format String Vulnerability Sun Solaris 7 rpc.rwalld Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris 7 X Font Server Remote Buffer Overrun Sun Solaris 7 fs.auto, xfs Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris 7 CDE ToolTalk Database Symbolic Link Vulnerability Sun Solaris 7 Common Desktop Environment CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris 7 CDE dtspcd Buffer Overflow Sun Solaris 7 dtspcd Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris 7 CDE ToolTalk Database Heap Corruption Vulnerability Sun Solaris 7 Common Desktop Environment Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris 7 CDE ToolTalk Database Null Write Vulnerability Sun Solaris 7 Common Desktop Environment CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED ACCEPTED cachefsd DoS via Invalid RPC Request Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 cachefsd cachefsd in Solaris 2.6, 7, and 8 allows remote attackers to cause a denial of service (crash) via an invalid procedure call in an RPC request. Brian Soby DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris 7 cachefsd Buffer Overrun Vulnerability Sun Solaris 7 cachefsd Buffer overflow in the fscache_setup function of cachefsd in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long mount argument. David Proulx Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Solaris SAdmin Client Credentials Remote Administrative Access Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Sadmin The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets. Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Todd Dolinsky INTERIM Todd Dolinsky ACCEPTED ACCEPTED Solaris 7 cachefsd Heap Overflow Vulnerability Sun Solaris 7 cachefsd Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. David Proulx Brian Soby INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED ACCEPTED Buffer Overflow in "in.telnetd"or "telnetd"Process Sun Solaris 7 Sun Solaris 8 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability With Loading Arbitrary Kernel Modules in Solaris Kernel Sun Solaris 8 Sun Solaris 9 Sun Solaris 7 Sun Solaris 2.6 Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED BSM Audit Kernel Panic Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Basic Security Module Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic). Brian Soby DRAFT Sudhir Gandhe DRAFT Security Vulnerability With Loading Arbitrary Kernel Modules in Solaris Kernel Sun Solaris 8 Sun Solaris 9 Sun Solaris 7 Sun Solaris 2.6 The kernel in Solaris 2.6, 7, 8, and 9 allows local users to gain privileges by loading arbitrary loadable kernel modules (LKM), possibly involving the modload function. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Solaris 7 (SPARC) is installed Sun Solaris 7 The operating system installed on the system is Sun Solaris 7 for SPARC. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Solaris 8 (x86) is installed Sun Solaris 8 The operating system installed on the system is Sun Solaris 8 for x86. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Solaris 7 (x86) is installed Sun Solaris 7 The operating system installed on the system is Sun Solaris 7 for x86. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Solaris 2.6 (x86) is installed Sun Solaris 2.6 The operating system installed on the system is Sun Solaris 2.6 for x86. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Solaris 9 (x86) is installed Sun Solaris 9 The operating system installed on the system is Sun Solaris 9 for x86. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Solaris 8 (SPARC) is installed Sun Solaris 8 The operating system installed on the system is Sun Solaris 8 for SPARC. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Solaris 9 (SPARC) is installed Sun Solaris 9 The operating system installed on the system is Sun Solaris 9 for SPARC. Jonathan Baker DRAFT INTERIM ACCEPTED ACCEPTED Solaris 2.6 (SPARC) is installed Sun Solaris 2.6 The operating system installed on the system is Sun Solaris 2.6 for SPARC. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Solaris CDE DTLogin XDMCP Parser Remote Double Free Vulnerability Sun Solaris 7 Common Desktop Environment Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet. Brian Soby Brian Soby DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM Jonathan Baker ACCEPTED ACCEPTED Solaris 7 KCMS Arbitrary File Access Vulnerability Sun Solaris 7 kcms_server Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. David Proulx Todd Dolinsky INTERIM ACCEPTED Dragos Prisaca DEPRECATED DEPRECATED KCMS KCS_OPEN_PROFILE File Disclosure Vulnerability Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 kcms_server Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure. Brian Soby DRAFT INTERIM ACCEPTED Todd Dolinsky INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED ACCEPTED