Vulnerabilities > CVE-2008-0965 - USE of Externally-Controlled Format String vulnerability in SUN Opensolaris, Solaris and Sunos
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Format String Injection An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
- String Format Overflow in syslog() This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.
Nessus
NASL family Solaris Local Security Checks NASL id SOLARIS8_108964.NASL description SunOS 5.8: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 33916 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33916 title Solaris 8 (sparc) : 108964-11 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(33916); script_version("1.22"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_xref(name:"IAVT", value:"2008-T-0043"); script_name(english:"Solaris 8 (sparc) : 108964-11"); script_summary(english:"Check for patch 108964-11"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 108964-11" ); script_set_attribute( attribute:"description", value: "SunOS 5.8: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08" ); script_set_attribute( attribute:"see_also", value:"http://download.oracle.com/sunalerts/1019497.1.html" ); script_set_attribute( attribute:"solution", value:"You should install this patch for your system to be up-to-date." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(119, 134); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris"); script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/08/17"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("solaris.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWhea", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++; if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWcsu", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++; if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWcsr", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report()); else security_hole(0); exit(0); } audit(AUDIT_HOST_NOT, "affected");
NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_138084-01.NASL description SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 108000 published 2018-03-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/108000 title Solaris 10 (x86) : 138084-01 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(108000); script_version("1.8"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_xref(name:"IAVT", value:"2008-T-0043"); script_name(english:"Solaris 10 (x86) : 138084-01"); script_summary(english:"Check for patch 138084-01"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 138084-01" ); script_set_attribute( attribute:"description", value: "SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08" ); script_set_attribute( attribute:"see_also", value:"https://download.oracle.com/sunalerts/1019497.1.html" ); script_set_attribute(attribute:"solution", value:"Install patch 138084-01"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(119, 134); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:138084"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10"); script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("solaris.inc"); showrev = get_kb_item("Host/Solaris/showrev"); if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris"); os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev); if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris"); full_ver = os_ver[1]; os_level = os_ver[2]; if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level); package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev); if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH); package_arch = package_arch[1]; if (package_arch != "i386") audit(AUDIT_ARCH_NOT, "i386", package_arch); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.10_x86", arch:"i386", patch:"138084-01", obsoleted_by:"141415-09 141445-09 141732-02 138105-01 ", package:"SUNWrcmdc", version:"11.10.0,REV=2005.01.21.16.34") < 0) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : solaris_get_report() ); } else { patch_fix = solaris_patch_fix_get(); if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10"); tested = solaris_pkg_tests_get(); if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWrcmdc"); }
NASL family Solaris Local Security Checks NASL id SOLARIS10_138083.NASL description SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2018-09-01 modified 2018-08-13 plugin id 33911 published 2008-08-17 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=33911 title Solaris 10 (sparc) : 138083-01 code #%NASL_MIN_LEVEL 80502 # @DEPRECATED@ # # This script has been deprecated as the associated patch is not # currently a recommended security fix. # # Disabled on 2011/10/24. # # # (C) Tenable Network Security, Inc. # # if ( ! defined_func("bn_random") ) exit(0); include("compat.inc"); if(description) { script_id(33911); script_version("1.20"); script_name(english: "Solaris 10 (sparc) : 138083-01"); script_xref(name:"IAVT", value:"2008-T-0043"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_set_attribute(attribute: "synopsis", value: "The remote host is missing Sun Security Patch number 138083-01"); script_set_attribute(attribute: "description", value: 'SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08'); script_set_attribute(attribute: "solution", value: "You should install this patch for your system to be up-to-date."); script_set_attribute(attribute: "see_also", value: "http://download.oracle.com/sunalerts/1019497.1.html"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(134); script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/17"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_summary(english: "Check for patch 138083-01"); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); family["english"] = "Solaris Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/Solaris/showrev"); exit(0); } # Deprecated. exit(0, "The associated patch is not currently a recommended security fix.");
NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_138084.NASL description SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2018-09-01 modified 2018-08-13 plugin id 33915 published 2008-08-17 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=33915 title Solaris 10 (x86) : 138084-01 code #%NASL_MIN_LEVEL 80502 # @DEPRECATED@ # # This script has been deprecated as the associated patch is not # currently a recommended security fix. # # Disabled on 2011/10/24. # # # (C) Tenable Network Security, Inc. # # if ( ! defined_func("bn_random") ) exit(0); include("compat.inc"); if(description) { script_id(33915); script_version("1.20"); script_name(english: "Solaris 10 (x86) : 138084-01"); script_xref(name:"IAVT", value:"2008-T-0043"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_set_attribute(attribute: "synopsis", value: "The remote host is missing Sun Security Patch number 138084-01"); script_set_attribute(attribute: "description", value: 'SunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08'); script_set_attribute(attribute: "solution", value: "You should install this patch for your system to be up-to-date."); script_set_attribute(attribute: "see_also", value: "http://download.oracle.com/sunalerts/1019497.1.html"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(134); script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/17"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_summary(english: "Check for patch 138084-01"); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); family["english"] = "Solaris Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/Solaris/showrev"); exit(0); } # Deprecated. exit(0, "The associated patch is not currently a recommended security fix.");
NASL family Solaris Local Security Checks NASL id SOLARIS10_138083-01.NASL description SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 107502 published 2018-03-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107502 title Solaris 10 (sparc) : 138083-01 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(107502); script_version("1.8"); script_cvs_date("Date: 2019/10/25 13:36:24"); script_cve_id("CVE-2008-0964", "CVE-2008-0965"); script_xref(name:"IAVT", value:"2008-T-0043"); script_name(english:"Solaris 10 (sparc) : 138083-01"); script_summary(english:"Check for patch 138083-01"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 138083-01" ); script_set_attribute( attribute:"description", value: "SunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08" ); script_set_attribute( attribute:"see_also", value:"https://download.oracle.com/sunalerts/1019497.1.html" ); script_set_attribute(attribute:"solution", value:"Install patch 138083-01"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(119, 134); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:138083"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10"); script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("solaris.inc"); showrev = get_kb_item("Host/Solaris/showrev"); if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris"); os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev); if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris"); full_ver = os_ver[1]; os_level = os_ver[2]; if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level); package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev); if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH); package_arch = package_arch[1]; if (package_arch != "sparc") audit(AUDIT_ARCH_NOT, "sparc", package_arch); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"138083-01", obsoleted_by:"141414-07 141444-09 138104-01 ", package:"SUNWrcmdc", version:"11.10.0,REV=2005.01.21.15.53") < 0) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : solaris_get_report() ); } else { patch_fix = solaris_patch_fix_get(); if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10"); tested = solaris_pkg_tests_get(); if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWrcmdc"); }
NASL family Solaris Local Security Checks NASL id SOLARIS8_X86_108965.NASL description SunOS 5.8_x86: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08 last seen 2020-06-01 modified 2020-06-02 plugin id 33918 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33918 title Solaris 8 (x86) : 108965-11 NASL family Solaris Local Security Checks NASL id SOLARIS9_X86_114262.NASL description SunOS 5.9_x86: snoop Patch. Date this patch was last updated by Sun : Jan/06/09 last seen 2020-06-01 modified 2020-06-02 plugin id 33921 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33921 title Solaris 9 (x86) : 114262-05 NASL family Solaris Local Security Checks NASL id SOLARIS9_112915.NASL description SunOS 5.9: snoop Patch. Date this patch was last updated by Sun : Jan/06/09 last seen 2020-06-01 modified 2020-06-02 plugin id 33919 published 2008-08-17 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33919 title Solaris 9 (sparc) : 112915-06
Oval
accepted | 2008-09-22T04:00:30.399-04:00 | ||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||
description | Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet. | ||||||||||||||||||||||||
family | unix | ||||||||||||||||||||||||
id | oval:org.mitre.oval:def:5742 | ||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||
submitted | 2008-08-11T12:08:06.000-04:00 | ||||||||||||||||||||||||
title | Security Vulnerability in Solaris snoop(1M) when Displaying SMB Traffic | ||||||||||||||||||||||||
version | 34 |
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 30556 CVE ID:CVE-2008-0964 CVE-2008-0965 CNCVE ID:CNCVE-20080964 CNCVE-20080965 Sun Solaris是一款商业性质的操作系统。 snoop(1M)网络工具相关的SMB通信显示存在安全问题,远程攻击者可以利用漏洞以'nobody'权限或其他本地用户权限执行任意命令。 目前没有详细漏洞细节提供。 如下平台受此漏洞影响: Solaris 10 Solaris 9 Solaris 8 OpenSolaris builds snv_01 to snv_95 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8 Sun Solaris 10_x86 Sun Solaris 10 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 可参考如下安全公告获得补丁信息: <a href=http://sunsolve.sun.com/search/document.do?assetkey=1-66-240101-1 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=1-66-240101-1</a> |
id | SSV:3803 |
last seen | 2017-11-19 |
modified | 2008-08-07 |
published | 2008-08-07 |
reporter | Root |
title | Sun Solaris 'snoop(1M)'工具远程命令执行漏洞 |
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=735
- http://secunia.com/advisories/31386
- http://secunia.com/advisories/31535
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-240101-1
- http://support.avaya.com/elmodocs2/security/ASA-2008-355.htm
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=766935
- http://www.securityfocus.com/bid/30556
- http://www.securitytracker.com/id?1020633
- http://www.vupen.com/english/advisories/2008/2311
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44222
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44415
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5742