Sun Microsystems Solaris NSPR Library Arbitrary File Creation Vulnerability
12 Oct. 2006
Summary
The Netscape Portable Runtime (NSPR) API allows compliant applications to use system facilities such as threads, thread synchronization, I/O, interval timing, atomic operations and several other low-level services in a platform-independent manner.
Local exploitation of a design error vulnerability in NSPR, as included with Sun Microsystems Solaris 10, allows attackers to create or overwrite arbitrary files on the system.
Vulnerable Systems:
* Sun Microsystems Solaris 10 with NSPR version 4.6.1.
The problem exists because environment variables are used to create log files. Even when the program is setuid, users can specify a log file that will be created with elevated privileges.
Exploitation allows local attackers to elevate privileges to root.
