Manipulated Tag Files used with Solaris Text Editors May Lead to Execution of Arbitrary Code

The OVAL Repository 5.5 2008-10-07T09:09:56.205-04:00 Manipulated Tag Files used with Solaris Text Editors May Lead to Execution of Arbitrary Code Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple unspecified vulnerabilities in Sun Solaris 8 through 10 allow local users to gain privileges via vectors related to handling of tags with (1) the -t option and (2) the :tag command in the (a) vi, (b) ex, (c) vedit, (d) view, and (e) edit programs. Todd Dolinsky DRAFT DRAFT Covert Channel Security Vulnerability in the Solaris Kernel Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls. Nicholas Hansen DRAFT INTERIM INTERIM Security Vulnerability in Solaris snoop(1M) when Displaying SMB Traffic Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED A Security Vulnerability in the namefs Kernel module may result in Arbitrary Code Execution or a Denial of Service (DoS) Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the namefs kernel module in Sun Solaris 8 through 10 allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in Solaris snoop(1M) when Displaying SMB Traffic Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple stack-based buffer overflows in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via a crafted SMB packet. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in the Solaris crontab(1) utility may allow execution of Arbitrary Code Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in crontab on Sun Solaris 8 through 10, and OpenSolaris before snv_93, allows local users to insert cron jobs into the crontab files of arbitrary users via unspecified vectors. Nicholas Hansen DRAFT INTERIM Dragos Prisaca ACCEPTED ACCEPTED CGI.pm start_form Cross-Site Scripting Vulnerability Sun Solaris 8 Sun Solaris 9 Perl Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED ACCEPTED Safe.PM Unsafe Code Execution Vulnerability Sun Solaris 8 Sun Solaris 9 Perl Safe.pm 2.0.7 and earlier, when used in Perl 5.8.0 and earlier, may allow attackers to break out of safe compartments in (1) Safe::reval or (2) Safe::rdo using a redefined @_ variable, which is not reset between successive calls. Robert L. Hollis DRAFT INTERIM ACCEPTED Nabil Ouchn INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED ACCEPTED Security Vulnerabilities in Solaris Print Service May Lead to Denial of Service (DoS) or Execution of Arbitrary Code Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8, 9, and 10 allow remote attackers to cause a denial of service or execute arbitrary code via unknown vectors. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED A Security Vulnerability in the Handling of Self Encapsulated IP Packets may Lead to a Denial of Service (DOS) Condition. Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Sun Solaris 8, 9, and 10 allows "remote privileged" users to cause a denial of service (panic) via unknown vectors related to self encapsulated IP packets. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability May Allow Firewall Compromise or Creation of Denial of Service (DoS) Condition Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service (panic) via unknown vectors, possibly related to ICMP packets and IP fragment reassembly. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in Solaris 8 Directory Functions Sun Solaris 8 Unspecified vulnerability in Sun Solaris 8 directory functions allows local users to cause a denial of service (panic) via an unspecified sequence of system calls or commands. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED OpenSSL Double-free Vulnerability Sun Solaris 8 Sun Solaris 9 Sun Cluster Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding. Brian Soby DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in the Solaris X Server May Lead to Unauthorized Disclosure of Information on Access Restricted Files and Directories Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in FreeType 2 Font Engine May Allow Privilege Escalation Due to Heap Overflow Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability With Loading Arbitrary Kernel Modules in Solaris Kernel Sun Solaris 8 Sun Solaris 9 Sun Solaris 7 Sun Solaris 2.6 The kernel in Solaris 2.6, 7, 8, and 9 allows local users to gain privileges by loading arbitrary loadable kernel modules (LKM), possibly involving the modload function. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED BSM Audit Kernel Panic Sun Solaris 7 Sun Solaris 8 Sun Solaris 9 Basic Security Module Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic). Brian Soby DRAFT Sudhir Gandhe DRAFT Security Vulnerability in RPCSEC_GSS (rpcsec_gss(3NSL)) Affects Kerberos Administration Daemon (kadmind(1M)) Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerabilities in Solaris Kernel Statistics Retrieval Process May Allow a Denial of Service (DoS) Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Multiple unspecified vulnerabilities in the kernel in Sun Solaris 8 through 10 allow local users to cause a denial of service (panic), related to the support for retrieval of kernel statistics, and possibly related to the sfmmu_mlspl_enter or sfmmu_mlist_enter functions. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in BIND 8 May Allow Cache Poisoning Attack Sun Solaris 8 Sun Solaris 9 The (1) NSID_SHUFFLE_ONLY and (2) NSID_USE_POOL PRNG algorithms in ISC BIND 8 before 8.4.7-P1 generate predictable DNS query identifiers when sending outgoing queries such as NOTIFY messages when answering questions as a resolver, which allows remote attackers to poison DNS caches via unknown vectors. NOTE: this issue is different from CVE-2007-2926. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in the vuidmice(7M) STREAMS Modules May Lead to a Denial of Service (DoS) Condition Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access to cause a denial of service ("unusable" system console) via unspecified vectors. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in Solaris Named Pipes (pipe(2)) May Allow Unauthorized Data Access Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory locations via a negative value to the I_PEEK ioctl. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in the Human Interface Device (HID) Class Driver for Solaris Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the HID (Human Interface Device) class driver in Sun Solaris 8, 9, and 10 before 20070925 allows local users to cause a denial of service (panic) via unspecified vectors. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED A Security Vulnerability in the Handling of Thread Contexts in the Solaris Kernel May Allow a Denial of Service (DoS) Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors related to "the handling of thread contexts." Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability With Loading Arbitrary Kernel Modules in Solaris Kernel Sun Solaris 8 Sun Solaris 9 Sun Solaris 7 Sun Solaris 2.6 Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Solaris 7 (SPARC) is installed Sun Solaris 7 The operating system installed on the system is Sun Solaris 7 for SPARC. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Solaris 7 (x86) is installed Sun Solaris 7 The operating system installed on the system is Sun Solaris 7 for x86. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Solaris 2.6 (x86) is installed Sun Solaris 2.6 The operating system installed on the system is Sun Solaris 2.6 for x86. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED Solaris 2.6 (SPARC) is installed Sun Solaris 2.6 The operating system installed on the system is Sun Solaris 2.6 for SPARC. Nicholas Hansen DRAFT INTERIM ACCEPTED ACCEPTED A Security Vulnerability With the Special File System (SPECFS) strfreectty() Function May Allow a Local Unprivileged User to Panic a System Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Unspecified vulnerability in the strfreectty function in the Special File System (SPECFS) in Sun Solaris 8 through 10 allows local users to cause a denial of service (system panic), related to passing a NULL pointer to the pgsignal function. Todd Dolinsky DRAFT INTERIM ACCEPTED ACCEPTED Solaris Hosts are Vulnerable to a Denial of Service Induced by an Internet Transmission Control Protocol (TCP) "ACK Storm" Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 The TCP implementation in Sun Solaris 8, 9, and 10 before 20060726 allows remote attackers to cause a denial of service (resource exhaustion) via a TCP packet with an incorrect sequence number, which triggers an ACK storm. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in the kcms_calibrate(1) Command Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in kcms_calibrate in Sun Solaris 8 and 9 before 20071122 allows local users to execute arbitrary commands via unknown vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability May Allow Users With the "File System Management" RBAC Profile to Gain Elevated Privileges Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in Sun Solaris 8 and 9 before 20060821 allows local users to execute arbitrary commands via unspecified vectors, involving the default Role-Based Access Control (RBAC) settings in the "File System Management" profile. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability May Allow Users With the "File System Management" RBAC Profile to Gain Elevated Privileges Sun Solaris 8 Sun Solaris 9 Unspecified vulnerability in the format command in Sun Solaris 8 and 9 before 20060821 allows local users to modify arbitrary files via unspecified vectors involving profiles that permit running format with elevated privileges, a different issue than CVE-2006-4306 and CVE-2006-4319. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED A Security Vulnerability in the Solaris Kernel May Allow a Denial of Service (DoS) Condition to Occur Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors, possibly related to the exitlwps function and SIGKILL and /proc PCAGENT signals. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in X Display Manager (xdm(1)) Xsession Script Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Race condition in the Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060225, and Solaris 8 through 10 before 20061006, causes a user's Xsession errors file to have weak permissions before a chmod is performed, which allows local users to read Xsession errors files of other users. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Buffer Overflow Vulnerability in libX11 Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and earlier, as used in SCO UnixWare 7.1.3 and Sun Solaris 8 through 10, allows local users to gain privileges via a long _XKB_CHARSET environment variable value. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerabilities in Solaris ld.so.1(1) may Lead to Execution of Arbitrary Code with Elevated Privileges Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 Stack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. NOTE: this issue normally does not cross privilege boundaries, except in cases of external introduction of malicious message files, or if it is leveraged with other vulnerabilities such as CVE-2006-6494. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED Security Vulnerability in Sun Remote Services (SRS) Net Connect Software Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED