Sun Solaris printd Daemon Arbitrary File Deletion Vulnerability - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

Sun Solaris printd Daemon Arbitrary File Deletion Vulnerability

Secunia Advisory:	SA16367
Release Date:	2005-08-09
Last Update:	2005-10-20

Critical:	Less critical
Impact:	Manipulation of data
Where:	From local network
Solution Status:	Vendor Patch

OS:	Sun Solaris 10 Sun Solaris 7 Sun Solaris 8 Sun Solaris 9


	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: A vulnerability has been reported in Solaris, which can be exploited by malicious users to delete files on a vulnerable system. The vulnerability is caused due to an error in the printd daemon when handling cascaded job requests. This can be exploited to delete arbitrary files from the system with the privileges of the user running the printd daemon via a specially crafted cascaded job request. NOTE: An exploit for the vulnerability is publicly available. Solution: Apply patches. -- SPARC Platform -- Solaris 7: Apply patch 107115-19 or later. Solaris 8: Apply patch 109320-16 or later. Solaris 9: Apply patch 113329-15 or later. Solaris 10: Apply patch 120467-01 or later. -- x86 Platform -- Solaris 7: Appy patch 107116-19 or later. Solaris 8: Apply patch 109321-16 or later. Solaris 9: Apply patch 114980-16 or later. Solaris 10: Apply patch 120468-01 or later. Provided and/or discovered by: The vendor credits H.D. Moore. Changelog: 2005-10-20: Updated "Description" and "Original Advisory" sections. Original Advisory: Sun Microsystems: http://sunsolve.sun.com/search/document.do?assetkey=1-26-101842-1 Metasploit Project: http://www.metasploit.com/projects/Framework/exploits.html#solaris_lpd_unlink



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

363 Related Secunia Security Advisories, displaying 10

1. Sun Solaris Kernel Covert Channel Security Bypass

2. Sun Solaris NFS RPC Zones Denial of Service

3. Sun Solaris NFS Kernel Module Denial of Service

4. Sun Solaris NFSv4 Client Kernel Module Denial of Service

5. Sun Solaris "sendfilev()" Denial of Service

6. Sun Solaris Trusted Extensions Labeled Networking Unauthorised Access

7. Sun Solaris "snoop" Multiple Vulnerabilities

8. Sun Solaris namefs Kernel Module Privilege Escalation

9. Sun Solaris Adobe Reader Multiple Vulnerabilities

10. Sun Solaris "pthread_mutex_reltimedlock_np" Local Denial of Service

Show all related advisories

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Novell eDirectory Multiple Vulnerabilities

2.	HP TCP/IP Services for OpenVMS Finger Format String Vulnerability

3.	dotProject SQL Injection and Cross-Site Scripting

4.	Red Hat update for libtiff

5.	Adium MSN SLP Message Integer Overflow Vulnerabilities

6.	Ultra Office ActiveX Control Multiple Vulnerabilities

7.	Caudium "configvar" Insecure Temporary Files

8.	Sun Solaris Kernel Covert Channel Security Bypass

9.	Red Hat update for libtiff

10.	Blogn Cross-Site Scripting and Cross-Site Request Forgery