Executive brief
A vulnerability in a core system library of the Solaris operating system could allow a local user to take full control of the machine. By providing an unexpectedly long program name when running a command, an attacker can trigger a memory error that grants them administrative (root) privileges. This poses a significant risk to the integrity and confidentiality of data on affected systems.
Technical details
A classic buffer overflow exists in the 'getopt' function within the Solaris standard C library (libc). The vulnerability is triggered when a program using getopt is executed with an excessively long string in the first argument of the argument vector (argv[0]). Because many system utilities run with elevated privileges (setuid root), a local attacker can exploit this memory corruption to overwrite the execution stack and redirect process flow to arbitrary code. This results in a full privilege escalation from a standard user to root. The issue affects Solaris 2.5 and SunOS 5.5.
Affected products
- Sun Microsystems Solaris 2.5, 5.5
Timeline
- 1997-01-27: disclosed