Description
srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sun Microsystems Solaris SRSEXEC 3.2.x - Arbitrary File Read Local Information Disclosure EDB-30021 · local · May 10, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:1920 vdb-entry signature
- 35940 vdb-entry
- 1018046 vdb-entry
- sunsrs-srsexec-information-disclosure(34223) vdb-entry
- 25194 third-party-advisory
- 102891 vendor-advisory
- 23915 vdb-entry
- ADV-2007-1769 vdb-entry
- 20070510 Sun Microsystems Solaris SRS Proxy Core srsexec Arbitrary File Read Vulnerability third-party-advisory