Executive brief
A vulnerability exists in the rdist utility, a tool used in older Unix-based systems to maintain identical copies of files across multiple hosts. A local user with access to the system can exploit a flaw in how the tool handles internal data to gain full administrative (root) control. This allows an unauthorized individual to access sensitive data, modify system files, or disrupt operations.
Technical details
A stack-based buffer overflow exists in the rdist utility within the lookup() function. The vulnerability is triggered when the application fails to properly validate the length of input data before copying it into a fixed-size buffer. Because rdist is often installed with setuid root permissions to facilitate file distribution across systems, a local attacker can exploit this overflow to execute arbitrary code with elevated privileges. This allows for a complete compromise of the local host. The issue affects several versions of SunOS and Solaris.
Affected products
- Sun Microsystems Solaris/SunOS 4.1.3, 4.1.4, 5.3, 5.4, 5.5, 5.5.1
Timeline
- 1996-07-24: disclosed