Re: [Full-disclosure] Solaris 9/10 ld.so fun

To: full-disclosure@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] Solaris 9/10 ld.so fun
From: Przemyslaw Frasunek <venglin@xxxxxxxxxxxxxxxxx>
Date: Tue, 28 Jun 2005 18:17:02 +0200
In-reply-to: <42C087BE.5090400@xxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Organization: czuby.net
References: <42C087BE.5090400@xxxxxxxxxxxxxxxxx>
User-agent: Mozilla Thunderbird 1.0.2 (X11/20050626)

Przemyslaw Frasunek wrote:
> - SunOS 5.10 Generic i86pc i386 i86pc
> - SunOS 5.9 Generic_112233-12 sun4u

This vulnerability was introduced by one of the recent patches for Solaris 9,
possibly 112963. Ld.so patched with 112963-08 is not vulnerable -- it does
not allow LD_AUDIT for set[ug]id binaries, but upgrading to 112963-16
definitly makes ld.so exploitable.

Up-to-date Solaris 8 boxes are also vulnerable. Solaris 10 boxes are
vulnerable, both patched and unpatched.

-- 
* Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE *
* JID: venglin@xxxxxxxxxxxxxxx ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *

Follow-Ups:
- Re: [Full-disclosure] Solaris 9/10 ld.so fun
  - From: Przemyslaw Frasunek
- Re: [Full-disclosure] Solaris 9/10 ld.so fun
  - From: Piotr KUCHARSKI

References:
- Solaris 9/10 ld.so fun
  - From: Przemyslaw Frasunek

Prev by Date: Re: [Full-disclosure] Solaris 9/10 ld.so fun
Next by Date: XSS IN Community forum
Previous by thread: Re: [Full-disclosure] Solaris 9/10 ld.so fun
Next by thread: Re: [Full-disclosure] Solaris 9/10 ld.so fun
Index(es):
- Date
- Thread