Vulnerabilities > CVE-2006-4319 - Buffer Overflow vulnerability in SUN Solaris and Sunos
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to format (such as the "File System Management" RBAC profile) to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2006-4307.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
OS | 13 |
Nessus
NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_118997.NASL description SunOS 5.10_x86: format patch. Date this patch was last updated by Sun : Aug/21/06 last seen 2018-09-01 modified 2018-08-13 plugin id 22245 published 2006-08-21 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22245 title Solaris 10 (x86) : 118997-10 code #%NASL_MIN_LEVEL 80502 # @DEPRECATED@ # # This script has been deprecated as the associated patch is not # currently a recommended security fix. # # Disabled on 2011/09/17. # # (C) Tenable Network Security, Inc. # # if ( ! defined_func("bn_random") ) exit(0); include("compat.inc"); if(description) { script_id(22245); script_version("1.29"); script_name(english: "Solaris 10 (x86) : 118997-10"); script_cve_id("CVE-2006-4319"); script_set_attribute(attribute: "synopsis", value: "The remote host is missing Sun Security Patch number 118997-10"); script_set_attribute(attribute: "description", value: 'SunOS 5.10_x86: format patch. Date this patch was last updated by Sun : Aug/21/06'); script_set_attribute(attribute: "solution", value: "You should install this patch for your system to be up-to-date."); script_set_attribute(attribute: "see_also", value: "https://getupdates.oracle.com/readme/118997-10"); script_set_attribute(attribute: "cvss_vector", value: "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"plugin_publication_date", value: "2006/08/21"); script_cvs_date("Date: 2019/10/25 13:36:23"); script_set_attribute(attribute:"vuln_publication_date", value: "2006/08/21"); script_end_attributes(); script_summary(english: "Check for patch 118997-10"); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc."); family["english"] = "Solaris Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/Solaris/showrev"); exit(0); } # Deprecated. exit(0, "The associated patch is not currently a recommended security fix.");
NASL family Solaris Local Security Checks NASL id SOLARIS9_113072.NASL description SunOS 5.9: patch /usr/sbin/format. Date this patch was last updated by Sun : Jul/21/06 last seen 2020-06-01 modified 2020-06-02 plugin id 22157 published 2006-08-04 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22157 title Solaris 9 (sparc) : 113072-08 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(22157); script_version("1.23"); script_cvs_date("Date: 2019/10/25 13:36:23"); script_cve_id("CVE-2006-4319"); script_name(english:"Solaris 9 (sparc) : 113072-08"); script_summary(english:"Check for patch 113072-08"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 113072-08" ); script_set_attribute( attribute:"description", value: "SunOS 5.9: patch /usr/sbin/format. Date this patch was last updated by Sun : Jul/21/06" ); script_set_attribute( attribute:"see_also", value:"http://download.oracle.com/sunalerts/1000354.1.html" ); script_set_attribute( attribute:"solution", value:"You should install this patch for your system to be up-to-date." ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris"); script_set_attribute(attribute:"patch_publication_date", value:"2006/07/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/08/04"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("solaris.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.9", arch:"sparc", patch:"113072-08", obsoleted_by:"", package:"SUNWcsu", version:"11.9.0,REV=2002.04.06.15.27") < 0) flag++; if (solaris_check_patch(release:"5.9", arch:"sparc", patch:"113072-08", obsoleted_by:"", package:"SUNWcsr", version:"11.9.0,REV=2002.04.06.15.27") < 0) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report()); else security_hole(0); exit(0); } audit(AUDIT_HOST_NOT, "affected");
NASL family Solaris Local Security Checks NASL id SOLARIS9_X86_114423.NASL description SunOS 5.9_x86: format, lp, IKE patch. Date this patch was last updated by Sun : Mar/18/11 last seen 2020-06-01 modified 2020-06-02 plugin id 22248 published 2006-08-21 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22248 title Solaris 9 (x86) : 114423-09 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(22248); script_version("1.27"); script_cvs_date("Date: 2019/10/25 13:36:27"); script_cve_id("CVE-2006-4319", "CVE-2008-2144"); script_bugtraq_id(29135); script_xref(name:"IAVT", value:"2008-T-0021"); script_name(english:"Solaris 9 (x86) : 114423-09"); script_summary(english:"Check for patch 114423-09"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 114423-09" ); script_set_attribute( attribute:"description", value: "SunOS 5.9_x86: format, lp, IKE patch. Date this patch was last updated by Sun : Mar/18/11" ); script_set_attribute( attribute:"see_also", value:"https://getupdates.oracle.com/readme/114423-09" ); script_set_attribute( attribute:"solution", value:"You should install this patch for your system to be up-to-date." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris"); script_set_attribute(attribute:"patch_publication_date", value:"2011/03/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/08/21"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("solaris.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWcstl", version:"11.9.0,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWscplp", version:"13.1,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWpsf", version:"13.1,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWpsr", version:"13.1,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWpsu", version:"13.1,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWcsu", version:"11.9.0,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWppm", version:"11.9.0,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWcsr", version:"11.9.0,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWpcu", version:"13.1,REV=2002.11.04.02.51") < 0) flag++; if (solaris_check_patch(release:"5.9_x86", arch:"i386", patch:"114423-09", obsoleted_by:"", package:"SUNWcsl", version:"11.9.0,REV=2002.11.04.02.51") < 0) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report()); else security_hole(0); exit(0); } audit(AUDIT_HOST_NOT, "affected");
NASL family Solaris Local Security Checks NASL id SOLARIS10_118833.NASL description SunOS 5.10: kernel patch. Date this patch was last updated by Sun : Jan/29/07 This plugin has been deprecated and either replaced with individual 118833 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 21792 published 2006-07-03 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=21792 title Solaris 10 (sparc) : 118833-36 (deprecated) NASL family Solaris Local Security Checks NASL id SOLARIS8_108975.NASL description SunOS 5.8: /usr/bin/rmformat and /usr/sbin/format patch. Date this patch was last updated by Sun : Aug/10/06 last seen 2020-06-01 modified 2020-06-02 plugin id 13304 published 2004-07-12 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/13304 title Solaris 8 (sparc) : 108975-10 NASL family Solaris Local Security Checks NASL id SOLARIS8_X86_108976.NASL description SunOS 5.8_x86: /usr/bin/rmformat and /usr/sbin/format patch. Date this patch was last updated by Sun : Aug/18/06 last seen 2020-06-01 modified 2020-06-02 plugin id 13415 published 2004-07-12 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/13415 title Solaris 8 (x86) : 108976-10
Oval
accepted | 2007-09-27T08:57:45.469-04:00 | ||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||
description | Buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to format (such as the "File System Management" RBAC profile) to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2006-4307. | ||||||||||||||||||||||||
family | unix | ||||||||||||||||||||||||
id | oval:org.mitre.oval:def:2164 | ||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||
submitted | 2007-08-10T12:25:25.000-04:00 | ||||||||||||||||||||||||
title | Security Vulnerability Due to Buffer Overflow in The format(1M) Command May Allow Privilege Elevation For Certain RBAC Profiles | ||||||||||||||||||||||||
version | 35 |
References
- http://secunia.com/advisories/21581
- http://secunia.com/advisories/22295
- http://securitytracker.com/id?1016727
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102519-1
- http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm
- http://www.securityfocus.com/bid/19657
- http://www.vupen.com/english/advisories/2006/3355
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28519
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2164