/usr/bin/solstice is setgid bin and gives this privilege away freely.
Unknown (it was known before the attached post)
group bin, which leads quickly to root (local)
Systems with vulnerable /usr/bin/solstice (Solaris 2.5, 2.5.1)
18 October 1996 (known prior to this)
From: Grant Kaufmann (email@example.com)
Date: Fri, 18 Oct 1996 09:36:56 +0200
/usr/bin/solstice is a program launcher under solaris 2.5
Unfortunately, for some reason, it is distributed set-gid bin,
and politely launches any programs without revoking this.
(ignore any warnings/errors along the way)
click Add Applications
fill in any arbitary things for the fields, stick the program
you want to run as setgid bin (or create a sgid shell)
click on the icon which appears with your app name.
As an aside, is there any reason why Solaris distributes
with so many important (like /etc and /bin) as writable by
group? This really converts a lot of not-so-dangerous
set-gid vulnerabilities to root vulnerabilities.
Here is patch information:
From: Casper Dik (casper@HOLLAND.SUN.COM)
Date: Sat, 19 Oct 1996 11:28:11 +0200
>/usr/bin/solstice is a program launcher under solaris 2.5
>Unfortunately, for some reason, it is distributed set-gid bin,
>and politely launches any programs without revoking this.
This is a well known bug which has already been discussed here at length.
/usr/bin/solstice was first shipped with SOlaris 2.5/SunOS 5.5 so older
versions are not at risk.
These patches fix the bug, alternatively you can just remove the set-gid bit.
103245-07: Solaris 2.5_x86: admintool patch
103247-07: SunOS 5.5: admintool patch
103558-05: SunOS 5.5.1: admintool fixes for security and missing swmtool options
103559-05: SunOS 5.5.1_x86: admintool fixes for security/missing swmtool options
103560-05: SunOS 5.5.1_ppc: admintool fixes for security/missing swmtool options
The master index of all exploits is available
here (Very large file)
Or you can pick your favorite operating system:
This page is part of Fyodor's exploit
For a free program to automate scanning your network for vulnerable
hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resouces: