Executive brief
A security vulnerability exists in the xlock program, a utility used to lock terminal screens on Unix-based systems. A local user with access to the system can exploit this flaw to bypass security restrictions and execute commands with administrative (root) privileges. This could lead to a complete takeover of the affected machine and unauthorized access to all stored data.
Technical details
The xlock program contains a classic buffer overflow vulnerability (CWE-120) due to insufficient bounds checking on input data. Because xlock often runs with elevated privileges to manage screen locking and authentication, an attacker can provide specially crafted input to overflow a buffer and overwrite memory. This allows a local, unprivileged user to hijack the program's execution flow and execute arbitrary code with root privileges. The vulnerability is exploitable locally without requiring user interaction or prior administrative permissions.
Affected products
- Sun Solaris 2.3, 2.4, 2.5, 2.5.1
- Sun SunOS 5.3, 5.4, 5.5, 5.5.1
Timeline
- 1997-04-26: disclosed: Initial publication date in NVD