PT-2006-7099 · Sun · Sun Solaris

Publicado 2006-12-13 · Atualizado 2018-10-30 · CVE-2006-6495

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Solaris versions 8 through 10

Description The issue is a stack-based buffer overflow in ld.so.1, allowing local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. This issue does not normally cross privilege boundaries, except in cases where malicious message files are introduced externally or if it is leveraged with other vulnerabilities.

Recommendations For Sun Solaris versions 8 through 10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-6495

Produtos afetados

Sun Solaris

Referências · 11

• http://securitytracker.com/id?1017376 · Nota
• http://vupen.com/english/advisories/2006/4979 · Nota
• http://secunia.com/advisories/23317 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30848 · Nota
• http://securityfocus.com/bid/21564 · Nota
• http://secunia.com/advisories/23991 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102724-1 · Correção, Aviso do Fabricante
• http://support.avaya.com/elmodocs2/security/ASA-2007-019.htm · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=450 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-6495 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1909 · Nota