Vulnerabilities > CVE-2008-0965 - USE of Externally-Controlled Format String vulnerability in SUN Opensolaris, Solaris and Sunos

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
sun
CWE-134
critical
nessus

Summary

Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Format String Injection
    An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
  • String Format Overflow in syslog()
    This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.

Nessus

  • NASL familySolaris Local Security Checks
    NASL idSOLARIS8_108964.NASL
    descriptionSunOS 5.8: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08
    last seen2020-06-01
    modified2020-06-02
    plugin id33916
    published2008-08-17
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33916
    titleSolaris 8 (sparc) : 108964-11
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text in this plugin was
    # extracted from the Oracle SunOS Patch Updates.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(33916);
      script_version("1.22");
      script_cvs_date("Date: 2019/10/25 13:36:24");
    
      script_cve_id("CVE-2008-0964", "CVE-2008-0965");
      script_xref(name:"IAVT", value:"2008-T-0043");
    
      script_name(english:"Solaris 8 (sparc) : 108964-11");
      script_summary(english:"Check for patch 108964-11");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote host is missing Sun Security Patch number 108964-11"
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "SunOS 5.8: in.tftpd and snoop patch.
    Date this patch was last updated by Sun : Aug/04/08"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://download.oracle.com/sunalerts/1019497.1.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"You should install this patch for your system to be up-to-date."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_cwe_id(119, 134);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/08/17");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("solaris.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWhea", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++;
    if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWcsu", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++;
    if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108964-11", obsoleted_by:"", package:"SUNWcsr", version:"11.8.0,REV=2000.01.08.18.12") < 0) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report());
      else security_hole(0);
      exit(0);
    }
    audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_X86_138084-01.NASL
    descriptionSunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08
    last seen2020-06-01
    modified2020-06-02
    plugin id108000
    published2018-03-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108000
    titleSolaris 10 (x86) : 138084-01
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text in this plugin was
    # extracted from the Oracle SunOS Patch Updates.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(108000);
      script_version("1.8");
      script_cvs_date("Date: 2019/10/25 13:36:24");
    
      script_cve_id("CVE-2008-0964", "CVE-2008-0965");
      script_xref(name:"IAVT", value:"2008-T-0043");
    
      script_name(english:"Solaris 10 (x86) : 138084-01");
      script_summary(english:"Check for patch 138084-01");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote host is missing Sun Security Patch number 138084-01"
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "SunOS 5.10_x86: snoop patch.
    Date this patch was last updated by Sun : Aug/04/08"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://download.oracle.com/sunalerts/1019497.1.html"
      );
      script_set_attribute(attribute:"solution", value:"Install patch 138084-01");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(119, 134);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:138084");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("solaris.inc");
    
    showrev = get_kb_item("Host/Solaris/showrev");
    if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris");
    os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev);
    if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris");
    full_ver = os_ver[1];
    os_level = os_ver[2];
    if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level);
    package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev);
    if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH);
    package_arch = package_arch[1];
    if (package_arch != "i386") audit(AUDIT_ARCH_NOT, "i386", package_arch);
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    if (solaris_check_patch(release:"5.10_x86", arch:"i386", patch:"138084-01", obsoleted_by:"141415-09 141445-09 141732-02 138105-01 ", package:"SUNWrcmdc", version:"11.10.0,REV=2005.01.21.16.34") < 0) flag++;
    
    if (flag) {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : solaris_get_report()
      );
    } else {
      patch_fix = solaris_patch_fix_get();
      if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10");
      tested = solaris_pkg_tests_get();
      if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWrcmdc");
    }
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_138083.NASL
    descriptionSunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08
    last seen2018-09-01
    modified2018-08-13
    plugin id33911
    published2008-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=33911
    titleSolaris 10 (sparc) : 138083-01
    code
    #%NASL_MIN_LEVEL 80502
    
    # @DEPRECATED@
    #
    # This script has been deprecated as the associated patch is not
    # currently a recommended security fix.
    #
    # Disabled on 2011/10/24.
    #
    
    #
    # (C) Tenable Network Security, Inc.
    #
    #
    
    if ( ! defined_func("bn_random") ) exit(0);
    include("compat.inc");
    
    if(description)
    {
     script_id(33911);
     script_version("1.20");
    
     script_name(english: "Solaris 10 (sparc) : 138083-01");
     script_xref(name:"IAVT", value:"2008-T-0043");
     script_cve_id("CVE-2008-0964", "CVE-2008-0965");
     script_set_attribute(attribute: "synopsis", value:
    "The remote host is missing Sun Security Patch number 138083-01");
     script_set_attribute(attribute: "description", value:
    'SunOS 5.10: snoop patch.
    Date this patch was last updated by Sun : Aug/04/08');
     script_set_attribute(attribute: "solution", value:
    "You should install this patch for your system to be up-to-date.");
     script_set_attribute(attribute: "see_also", value:
    "http://download.oracle.com/sunalerts/1019497.1.html");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
     script_cwe_id(134);
     script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/17");
     script_cvs_date("Date: 2019/10/25 13:36:24");
     script_set_attribute(attribute:"stig_severity", value:"II");
     script_end_attributes();
    
     script_summary(english: "Check for patch 138083-01");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
     family["english"] = "Solaris Local Security Checks";
     script_family(english:family["english"]);
     
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/Solaris/showrev");
     exit(0);
    }
    
    # Deprecated.
    exit(0, "The associated patch is not currently a recommended security fix.");
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_X86_138084.NASL
    descriptionSunOS 5.10_x86: snoop patch. Date this patch was last updated by Sun : Aug/04/08
    last seen2018-09-01
    modified2018-08-13
    plugin id33915
    published2008-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=33915
    titleSolaris 10 (x86) : 138084-01
    code
    #%NASL_MIN_LEVEL 80502
    
    # @DEPRECATED@
    #
    # This script has been deprecated as the associated patch is not
    # currently a recommended security fix.
    #
    # Disabled on 2011/10/24.
    #
    
    #
    # (C) Tenable Network Security, Inc.
    #
    #
    
    if ( ! defined_func("bn_random") ) exit(0);
    include("compat.inc");
    
    if(description)
    {
     script_id(33915);
     script_version("1.20");
    
     script_name(english: "Solaris 10 (x86) : 138084-01");
     script_xref(name:"IAVT", value:"2008-T-0043");
     script_cve_id("CVE-2008-0964", "CVE-2008-0965");
     script_set_attribute(attribute: "synopsis", value:
    "The remote host is missing Sun Security Patch number 138084-01");
     script_set_attribute(attribute: "description", value:
    'SunOS 5.10_x86: snoop patch.
    Date this patch was last updated by Sun : Aug/04/08');
     script_set_attribute(attribute: "solution", value:
    "You should install this patch for your system to be up-to-date.");
     script_set_attribute(attribute: "see_also", value:
    "http://download.oracle.com/sunalerts/1019497.1.html");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
     script_cwe_id(134);
     script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/17");
     script_cvs_date("Date: 2019/10/25 13:36:24");
     script_set_attribute(attribute:"stig_severity", value:"II");
     script_end_attributes();
    
     script_summary(english: "Check for patch 138084-01");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
     family["english"] = "Solaris Local Security Checks";
     script_family(english:family["english"]);
     
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/Solaris/showrev");
     exit(0);
    }
    
    # Deprecated.
    exit(0, "The associated patch is not currently a recommended security fix.");
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_138083-01.NASL
    descriptionSunOS 5.10: snoop patch. Date this patch was last updated by Sun : Aug/04/08
    last seen2020-06-01
    modified2020-06-02
    plugin id107502
    published2018-03-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/107502
    titleSolaris 10 (sparc) : 138083-01
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text in this plugin was
    # extracted from the Oracle SunOS Patch Updates.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(107502);
      script_version("1.8");
      script_cvs_date("Date: 2019/10/25 13:36:24");
    
      script_cve_id("CVE-2008-0964", "CVE-2008-0965");
      script_xref(name:"IAVT", value:"2008-T-0043");
    
      script_name(english:"Solaris 10 (sparc) : 138083-01");
      script_summary(english:"Check for patch 138083-01");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote host is missing Sun Security Patch number 138083-01"
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "SunOS 5.10: snoop patch.
    Date this patch was last updated by Sun : Aug/04/08"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://download.oracle.com/sunalerts/1019497.1.html"
      );
      script_set_attribute(attribute:"solution", value:"Install patch 138083-01");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(119, 134);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:138083");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/08/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("solaris.inc");
    
    showrev = get_kb_item("Host/Solaris/showrev");
    if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris");
    os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev);
    if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris");
    full_ver = os_ver[1];
    os_level = os_ver[2];
    if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level);
    package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev);
    if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH);
    package_arch = package_arch[1];
    if (package_arch != "sparc") audit(AUDIT_ARCH_NOT, "sparc", package_arch);
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"138083-01", obsoleted_by:"141414-07 141444-09 138104-01 ", package:"SUNWrcmdc", version:"11.10.0,REV=2005.01.21.15.53") < 0) flag++;
    
    if (flag) {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : solaris_get_report()
      );
    } else {
      patch_fix = solaris_patch_fix_get();
      if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10");
      tested = solaris_pkg_tests_get();
      if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWrcmdc");
    }
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS8_X86_108965.NASL
    descriptionSunOS 5.8_x86: in.tftpd and snoop patch. Date this patch was last updated by Sun : Aug/04/08
    last seen2020-06-01
    modified2020-06-02
    plugin id33918
    published2008-08-17
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33918
    titleSolaris 8 (x86) : 108965-11
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS9_X86_114262.NASL
    descriptionSunOS 5.9_x86: snoop Patch. Date this patch was last updated by Sun : Jan/06/09
    last seen2020-06-01
    modified2020-06-02
    plugin id33921
    published2008-08-17
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33921
    titleSolaris 9 (x86) : 114262-05
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS9_112915.NASL
    descriptionSunOS 5.9: snoop Patch. Date this patch was last updated by Sun : Jan/06/09
    last seen2020-06-01
    modified2020-06-02
    plugin id33919
    published2008-08-17
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33919
    titleSolaris 9 (sparc) : 112915-06

Oval

accepted2008-09-22T04:00:30.399-04:00
classvulnerability
contributors
namePai Peng
organizationHewlett-Packard
definition_extensions
  • commentSolaris 10 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1440
  • commentSolaris 9 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1457
  • commentSolaris 8 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1539
  • commentSolaris 10 (x86) is installed
    ovaloval:org.mitre.oval:def:1926
  • commentSolaris 9 (x86) is installed
    ovaloval:org.mitre.oval:def:1683
  • commentSolaris 8 (x86) is installed
    ovaloval:org.mitre.oval:def:2059
descriptionMultiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet.
familyunix
idoval:org.mitre.oval:def:5742
statusaccepted
submitted2008-08-11T12:08:06.000-04:00
titleSecurity Vulnerability in Solaris snoop(1M) when Displaying SMB Traffic
version34

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 30556 CVE ID:CVE-2008-0964 CVE-2008-0965 CNCVE ID:CNCVE-20080964 CNCVE-20080965 Sun Solaris是一款商业性质的操作系统。 snoop(1M)网络工具相关的SMB通信显示存在安全问题,远程攻击者可以利用漏洞以'nobody'权限或其他本地用户权限执行任意命令。 目前没有详细漏洞细节提供。 如下平台受此漏洞影响: Solaris 10 Solaris 9 Solaris 8 OpenSolaris builds snv_01 to snv_95 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8 Sun Solaris 10_x86 Sun Solaris 10 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 可参考如下安全公告获得补丁信息: <a href=http://sunsolve.sun.com/search/document.do?assetkey=1-66-240101-1 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=1-66-240101-1</a>
idSSV:3803
last seen2017-11-19
modified2008-08-07
published2008-08-07
reporterRoot
titleSun Solaris 'snoop(1M)'工具远程命令执行漏洞