Description
The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Solaris libnspr NSPR_LOG_FILE Privilege Escalation
exploit/solaris/local/libnspr_nspr_log_file_priv_esc
Exploit-DB 6
- Solaris - libnspr NSPR_LOG_FILE Privilege Escalation (Metasploit) EDB-45433 · local · Sep 18, 2018 · verified
- Solaris 10 libnspr - 'Constructor' Arbitrary File Creation Privilege Escalation (3) EDB-2641 · local · Oct 24, 2006 · verified
- Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (2) EDB-28789 · local · Oct 24, 2006 · verified
- Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (2) EDB-2569 · local · Oct 16, 2006 · verified
- Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (1) EDB-2543 · local · Oct 13, 2006 · verified
- Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (1) EDB-28788 · local · Oct 13, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20471 vdb-entry
- ADV-2006-4016 vdb-entry
- 20061011 Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability third-party-advisory
- 20061013 Re: iDefense Security Advisory 10.11.06: Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability mailing-list
- 45433 exploit
- nspr-api-file-create(29489) vdb-entry
- 22348 third-party-advisory
- oval:org.mitre.oval:def:1819 vdb-entry signature
- 102658 vendor-advisory
- 1017050 vdb-entry