low3.6Public exploit code

CVE-2006-4842

The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Solaris - libnspr NSPR_LOG_FILE Privilege Escalation (Metasploit)2018-09-18 · local · solaris · Verified
Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (2)2006-10-24 · local · solaris · Verified
Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (1)2006-10-13 · local · solaris · Verified
Solaris 10 libnspr - 'Constructor' Arbitrary File Creation Privilege Escalation (3)2006-10-24 · local · solaris · Verified
Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (2)2006-10-16 · local · solaris · Verified
Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (1)2006-10-13 · local · solaris · Verified

Impact

The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.

Affected products

Vendor	Product	Affected versions
Netscape	Portable Runtime Api	Versions 4.6.1, 4.6.2
Sun	Solaris	Version 10.0

Weakness classification

CWE-20

Public exploit code

Impact

Affected products

Weakness classification

References