lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 12 Dec 2006 14:31:20 -0500
From: iDefense Labs <>
Subject: iDefense Security Advisory 12.12.06: Sun
 Microsystems Solaris Directory Traversal Vulnerability

Sun Microsystems Solaris Directory Traversal Vulnerability

iDefense Security Advisory 12.12.06
Dec 12, 2006


Solaris is a UNIX operating system developed by Sun Microsystems.  More
information can be found at


Local exploitation of a directory traversal vulnerability in could
potentially allow a non root user to execute arbitrary code as root. uses the environmental variables LANG, LC_ALL, and LC_MESSAGES to
determine what locale is currently set. When encounters an error,
such as when a non root user specifies an unsafe library in the LD_PRELOAD
environmental variable, it uses one of the above variables to open up a
message file that contains error strings. It will make a call like this to
open the file:


$LANG is a user controlled environmental variable that is not sanitized.
This message file is meant to contain format strings used to build error
messages, and should therefore only be writable by root. By setting LANG
to a value such as "../../../../../home/user" an attacker can control the
the location of this message file, and pass arbitrary format strings to a
printf() like function in


Successful local exploitation allows attackers to execute arbitrary code as
root on the affected host. does not use the C library printf() function; it has it's own
minimal implementation. This implementation does not provide the %n format
specifier. Therefore an attacker is limited to leaking information through
such specifiers as %x. However, while researching this vulnerability it
was found that the formatting function itself also contains a buffer
overflow vulnerability that can be triggered with a user controlled format
string. This vulnerability is discussed in a separate iDefense advisory. By
combining these two vulnerabilities it is possible that an attacker could
execute arbitrary code as root.


iDefense has confirmed that Solaris 10 for both x86 and SPARC is
vulnerable. It is speculated that older versions of Solaris are vulnerable
as well.


iDefense is currently unaware of any effective workarounds for this


Sun Microsystems has addressed this problem with new patches.  More
information can be found in Sun Alert #102724.  This alert can be found


A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.


10/24/2006  Initial vendor notification
10/27/2006  Initial vendor response
12/12/2006  Coordinated public disclosure


The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research

Free tools, research and upcoming events


Copyright © 2006 iDefense, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists