Re: iDefense Security Advisory 10.11.06: Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: iDefense Security Advisory 10.11.06: Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability
From: Marco Ivaldi <raptor@xxxxxxxxxxxxxxx>
Date: Fri, 13 Oct 2006 21:21:27 +0200 (CEST)
Cc: vulnwatch@xxxxxxxxxxxxx, full-disclosure@xxxxxxxxxxxxxxxxx
In-reply-to: <Pine.BSO.4.58.0610132110340.7832@xxxxxxxxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <Pine.BSO.4.58.0610132110340.7832@xxxxxxxxxxxxxxxxxxxxxxx>

On Wed, 11 Oct 2006, iDefense Labs wrote:

III. ANALYSIS

Exploitation allows local attackers to elevate privileges to root.


http://www.0xdeadbeef.info/exploits/raptor_libnspr

Oldschool style;)

I'll probably code a universal exploit using /etc/ld.so.preload on nextweek... But now the week-end has landed!


--
Marco Ivaldi
Antifork Research, Inc.   http://0xdeadbeef.info/
3B05 C9C5 A2DE C3D7 4233  0394 EF85 2008 DBFD B707