Executive brief
A vulnerability in the Solaris operating system's 'chkey' utility allows a local user to gain full administrative (root) control over the system. The 'chkey' tool is used to change a user's secure RPC encryption keys. By providing an unexpectedly long input to this tool, an attacker can crash the program in a way that allows them to execute their own commands with elevated privileges, potentially leading to a total system compromise.
Technical details
A buffer overflow vulnerability exists in the 'chkey' utility within Solaris 2.5.1 and earlier versions. The flaw is triggered by passing a long command-line argument to the utility, which fails to perform adequate bounds checking on the input. This is a classic data buffer overflow that can be exploited to overwrite the iob[] array of FILE structures used by stdio. By hijacking these streams, an attacker can redirect execution flow to arbitrary code, such as a shellcode payload, even on systems with non-executable stacks. Successful exploitation allows a local, unprivileged user to escalate their privileges to root. Sun Microsystems released patch 103612 to address this and related overflows in the affected versions.
Affected products
- Sun Microsystems Solaris 2.5.1 and earlier
- Sun Microsystems SunOS 5.5.1 and earlier
Timeline
- 1997-05-19: disclosed: Public disclosure and exploit discussion on Bugtraq
- 1997-05-19: advisory: NVD published date