Executive brief
A vulnerability in the mail delivery system of SunOS allows local users to gain full administrative control (root privileges) over the operating system. By providing specific command-line arguments to the mail utility, an attacker can bypass security restrictions to execute unauthorized commands. This could lead to a complete compromise of the system, including the theft of sensitive data and disruption of operations.
Technical details
A privilege escalation vulnerability exists in the /bin/mail utility of SunOS 4.1.1 and earlier. The flaw is triggered by improper handling of specific command-line arguments, which allows a local, unprivileged user to execute code with the elevated privileges of the root user. This is likely due to a lack of input validation or insecure handling of environment variables/arguments within a setuid binary. An attacker with local shell access can exploit this to achieve full system compromise. Patches were historically released by Sun Microsystems to address this issue.
Affected products
- Sun Microsystems SunOS 4.1.1 and earlier
Timeline
- 1991-02-22: disclosed: Initial publication of the vulnerability details.
- 1991-02-22: advisory: NVD published date.