Vulnerabilities > CVE-2008-0964 - Buffer Errors vulnerability in SUN Opensolaris, Solaris and Sunos
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Multiple stack-based buffer overflows in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via a crafted SMB packet.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Exploit-Db
description | Sun Solaris <= 10 snoop(1M) Utility Remote Exploit. CVE-2008-0964. Remote exploit for solaris platform |
file | exploits/solaris/remote/6328.c |
id | EDB-ID:6328 |
last seen | 2016-01-31 |
modified | 2008-08-29 |
platform | solaris |
port | |
published | 2008-08-29 |
reporter | Andi |
source | https://www.exploit-db.com/download/6328/ |
title | Sun Solaris <= 10 snoop1M Utility Remote Exploit |
type | remote |
Nessus
NASL family Solaris Local Security Checks NASL id SOLARIS8_108964.NASL description SunOS 5.8: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 33916 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33916 title Solaris 8 (sparc) : 108964-11 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(33916); script_version("1.22"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_xref(name:"IAVT", value:"2008-T-0043"); script_name(english:"Solaris 8 (sparc) : 108964-11"); script_summary(english:"Check for patch 108964-11"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 108964-11" ); script_set_attribute( attribute:"description", value: "SunOS 5.8: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08" ); script_set_attribute( attribute:"see_also", value:"http://download.oracle.com/sunalerts/1019497.1.html" ); script_set_attribute( attribute:"solution", value:"You should install this patch for your system to be up-to-date." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(119, 134); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris"); script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/08/17"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("solaris.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWhea", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++; if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWcsu", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++; if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWcsr", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report()); else security_hole(0); exit(0); } audit(AUDIT_HOST_NOT, "affected");
NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_138084-01.NASL description SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 108000 published 2018-03-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/108000 title Solaris 10 (x86) : 138084-01 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(108000); script_version("1.8"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_xref(name:"IAVT", value:"2008-T-0043"); script_name(english:"Solaris 10 (x86) : 138084-01"); script_summary(english:"Check for patch 138084-01"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 138084-01" ); script_set_attribute( attribute:"description", value: "SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08" ); script_set_attribute( attribute:"see_also", value:"https://download.oracle.com/sunalerts/1019497.1.html" ); script_set_attribute(attribute:"solution", value:"Install patch 138084-01"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(119, 134); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:138084"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10"); script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("solaris.inc"); showrev = get_kb_item("Host/Solaris/showrev"); if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris"); os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev); if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris"); full_ver = os_ver[1]; os_level = os_ver[2]; if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level); package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev); if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH); package_arch = package_arch[1]; if (package_arch != "i386") audit(AUDIT_ARCH_NOT, "i386", package_arch); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.10_x86", arch:"i386", patch:"138084-01", obsoleted_by:"141415-09 141445-09 141732-02 138105-01 ", package:"SUNWrcmdc", version:"11.10.0,REV=2005.01.21.16.34") < 0) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : solaris_get_report() ); } else { patch_fix = solaris_patch_fix_get(); if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10"); tested = solaris_pkg_tests_get(); if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWrcmdc"); }
NASL family Solaris Local Security Checks NASL id SOLARIS10_138083.NASL description SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2018-09-01 modified 2018-08-13 plugin id 33911 published 2008-08-17 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=33911 title Solaris 10 (sparc) : 138083-01 code #%NASL_MIN_LEVEL 80502 # @DEPRECATED@ # # This script has been deprecated as the associated patch is not # currently a recommended security fix. # # Disabled on 2011/10/24. # # # (C) Tenable Network Security, Inc. # # if ( ! defined_func("bn_random") ) exit(0); include("compat.inc"); if(description) { script_id(33911); script_version("1.20"); script_name(english: "Solaris 10 (sparc) : 138083-01"); script_xref(name:"IAVT", value:"2008-T-0043"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_set_attribute(attribute: "synopsis", value: "The remote host is missing Sun Security Patch number 138083-01"); script_set_attribute(attribute: "description", value: 'SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08'); script_set_attribute(attribute: "solution", value: "You should install this patch for your system to be up-to-date."); script_set_attribute(attribute: "see_also", value: "http://download.oracle.com/sunalerts/1019497.1.html"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(134); script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/17"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_summary(english: "Check for patch 138083-01"); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); family["english"] = "Solaris Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/Solaris/showrev"); exit(0); } # Deprecated. exit(0, "The associated patch is not currently a recommended security fix.");
NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_138084.NASL description SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2018-09-01 modified 2018-08-13 plugin id 33915 published 2008-08-17 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=33915 title Solaris 10 (x86) : 138084-01 code #%NASL_MIN_LEVEL 80502 # @DEPRECATED@ # # This script has been deprecated as the associated patch is not # currently a recommended security fix. # # Disabled on 2011/10/24. # # # (C) Tenable Network Security, Inc. # # if ( ! defined_func("bn_random") ) exit(0); include("compat.inc"); if(description) { script_id(33915); script_version("1.20"); script_name(english: "Solaris 10 (x86) : 138084-01"); script_xref(name:"IAVT", value:"2008-T-0043"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_set_attribute(attribute: "synopsis", value: "The remote host is missing Sun Security Patch number 138084-01"); script_set_attribute(attribute: "description", value: 'SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08'); script_set_attribute(attribute: "solution", value: "You should install this patch for your system to be up-to-date."); script_set_attribute(attribute: "see_also", value: "http://download.oracle.com/sunalerts/1019497.1.html"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(134); script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/17"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_summary(english: "Check for patch 138084-01"); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); family["english"] = "Solaris Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/Solaris/showrev"); exit(0); } # Deprecated. exit(0, "The associated patch is not currently a recommended security fix.");
NASL family Solaris Local Security Checks NASL id SOLARIS10_138083-01.NASL description SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 107502 published 2018-03-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107502 title Solaris 10 (sparc) : 138083-01 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(107502); script_version("1.8"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_xref(name:"IAVT", value:"2008-T-0043"); script_name(english:"Solaris 10 (sparc) : 138083-01"); script_summary(english:"Check for patch 138083-01"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 138083-01" ); script_set_attribute( attribute:"description", value: "SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08" ); script_set_attribute( attribute:"see_also", value:"https://download.oracle.com/sunalerts/1019497.1.html" ); script_set_attribute(attribute:"solution", value:"Install patch 138083-01"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(119, 134); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:138083"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10"); script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("solaris.inc"); showrev = get_kb_item("Host/Solaris/showrev"); if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris"); os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev); if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris"); full_ver = os_ver[1]; os_level = os_ver[2]; if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level); package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev); if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH); package_arch = package_arch[1]; if (package_arch != "sparc") audit(AUDIT_ARCH_NOT, "sparc", package_arch); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"138083-01", obsoleted_by:"141414-07 141444-09 138104-01 ", package:"SUNWrcmdc", version:"11.10.0,REV=2005.01.21.15.53") < 0) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : solaris_get_report() ); } else { patch_fix = solaris_patch_fix_get(); if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10"); tested = solaris_pkg_tests_get(); if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWrcmdc"); }
NASL family Solaris Local Security Checks NASL id SOLARIS8_X86_108965.NASL description SunOS 5.8_x86: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 33918 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33918 title Solaris 8 (x86) : 108965-11 NASL family Solaris Local Security Checks NASL id SOLARIS9_X86_114262.NASL description SunOS 5.9_x86: snoop Patch. Date this patch was last updated by Sun : Jan/06/09 last seen 2020-06-01 modified 2020-06-02 plugin id 33921 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33921 title Solaris 9 (x86) : 114262-05 NASL family Solaris Local Security Checks NASL id SOLARIS9_112915.NASL description SunOS 5.9: snoop Patch. Date this patch was last updated by Sun : Jan/06/09 last seen 2020-06-01 modified 2020-06-02 plugin id 33919 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33919 title Solaris 9 (sparc) : 112915-06
Oval
accepted | 2008-09-22T04:00:22.547-04:00 | ||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||
description | Multiple stack-based buffer overflows in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via a crafted SMB packet. | ||||||||||||||||||||||||
family | unix | ||||||||||||||||||||||||
id | oval:org.mitre.oval:def:5318 | ||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||
submitted | 2008-08-11T12:08:06.000-04:00 | ||||||||||||||||||||||||
title | Security Vulnerability in Solaris snoop(1M) when Displaying SMB Traffic | ||||||||||||||||||||||||
version | 35 |
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 30556 CVE ID:CVE-2008-0964 CVE-2008-0965 CNCVE ID:CNCVE-20080964 CNCVE-20080965 Sun Solaris是一款商业性质的操作系统。 snoop(1M)网络工具相关的SMB通信显示存在安全问题,远程攻击者可以利用漏洞以'nobody'权限或其他本地用户权限执行任意命令。 目前没有详细漏洞细节提供。 如下平台受此漏洞影响: Solaris 10 Solaris 9 Solaris 8 OpenSolaris builds snv_01 to snv_95 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8 Sun Solaris 10_x86 Sun Solaris 10 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 可参考如下安全公告获得补丁信息: <a href=http://sunsolve.sun.com/search/document.do?assetkey=1-66-240101-1 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=1-66-240101-1</a> |
id | SSV:3803 |
last seen | 2017-11-19 |
modified | 2008-08-07 |
published | 2008-08-07 |
reporter | Root |
title | Sun Solaris 'snoop(1M)'工具远程命令执行漏洞 |
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=734
- http://secunia.com/advisories/31386
- http://secunia.com/advisories/31535
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-240101-1
- http://support.avaya.com/elmodocs2/security/ASA-2008-355.htm
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=766935
- http://www.securityfocus.com/bid/30556
- http://www.securitytracker.com/id?1020633
- http://www.vupen.com/english/advisories/2008/2311
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44222
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5318
- https://www.exploit-db.com/exploits/6328