Executive brief
A vulnerability in the SunOS operating system's Network File System (NFS) allows local users to gain full administrative (root) control of the system. This occurs because the system incorrectly processes user identification numbers, failing to distinguish between certain high-numbered user accounts and the system administrator account. An attacker with a local account could exploit this to access sensitive data, modify system files, or disrupt operations.
Technical details
The vulnerability exists in the NFS implementation of SunOS versions 4.1, 4.1.1, and 4.1.2. The root cause is an integer truncation or improper handling of 32-bit User Identifiers (UIDs), where the system ignores the high-order 16 bits. A local attacker with a UID that has the lower 16 bits set to 0 (e.g., UID 65536) will be treated by the NFS service as UID 0 (root). This allows the attacker to bypass file system permissions and gain full root privileges on the host. The issue is resolved by applying the Sun NFS jumbo patch upgrade.
Affected products
- Sun Microsystems SunOS 4.1 through 4.1.2
Timeline
- 1992-12-30: advisory: NVD published date
- 1992-12-31: advisory: CERT advisory CA-1992-15 released