Xsun is the server of the X window system on Sun hardware. A buffer overflow was discovered in Xsun. Since Xsun is SUID root, exploiting this vulnerability yields root privileges. The overflow exists in Xsun's handling of the HOME environment variable.
Example:
bash-2.03$ HOME=`perl -e 'print "A"x1050'`
bash-2.03$ /usr/openwin/bin/Xsun :1
Warning: There is no XDISPLAY information for display 1.
Server is using XDISPLAY information for display 0.
Default Font Path: /usr/openwin/lib/X11/
Segmentation Fault (core dumped)
Exploit:
/***********************************/
Solaris 7 (x86) /usr/openwin/bin/Xsun
HOME environment overflow
Proof of Concept Exploitation
riley@eeye.com
Puts a Root shell on local port 1524
/***********************************/
Vendor Status:
Sun Microsystems has been contacted. They are currently working on patches for this and other related vulnerabilities eEye has discovered.
Workaround:
Run the following command line: 'chmod -s /usr/openwin/bin/Xsun'
This will remove the setuid bit from Xsun, therefore if someone does exploit this vulnerability, they won't gain higher privileges.
