PT-2005-3014 · Oracle · Solaris

Published 2005-06-29 · Updated 2018-10-30 · CVE-2005-2072

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Solaris versions 8 through 10

Description: The issue concerns the runtime linker (ld.so) in Solaris, which trusts the LD AUDIT environment variable in setuid or setgid programs. This trust allows local users to potentially gain privileges by modifying LD AUDIT to reference malicious code. Additionally, using a long value for LD AUDIT may be exploited.

Recommendations: For Solaris versions 8 through 10, consider restricting the use of the LD AUDIT environment variable in setuid or setgid programs to minimize the risk of exploitation. As a temporary workaround, avoid using long values for LD AUDIT until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2005-2072

Affected Products

Solaris

References · 12

• 🔥 https://exploit-db.com/exploits/1074 · Exploit
• 🔥 http://securityfocus.com/bid/14074 · Exploit
• 🔥 https://exploit-db.com/exploits/1073 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034730.html · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034731.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2072 · Security Note
• http://secunia.com/advisories/15841 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101794-1 · Vendor Advisory
• http://vupen.com/english/advisories/2005/0908 · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034738.html · Note
• http://opensolaris.org/jive/thread.jspa?messageID=3497 · Note
• http://securitytracker.com/id?1014537 · Note