Vulnerability CVE-2003-1071 - CERT Civis.Net

Vulnerability Name:

CVE-2003-1071 (CCN-11608)

Assigned:

2003-01-03

Published:

2003-01-03

Updated:

2018-10-30

Summary:

rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: CCN
Type: BugTraq Mailing List, Fri Jan 03 2003 - 10:53:17 CST
Solaris 2.x /usr/sbin/wall Advisory

Source: MITRE
Type: CNA
CVE-2003-1071

Source: CCN
Type: SA7825
Solaris spoofing vulnerability in wall

Source: SECUNIA
Type: Vendor Advisory
7825

Source: CCN
Type: SECTRACK ID: 1005882
`wall` (/usr/sbin/wall) Bug Lets Local Users Spoof Broadcast Messages

Source: CCN
Type: SECTRACK ID: 1006682
(Sun Issues Fix) Re: wall (/usr/sbin/wall) Bug Lets Local Users Spoof Broadcast Messages

Source: CCN
Type: Sun Alert ID: 51980
The wall(1M) Command May be Used to Send Messages Containing a Forged User ID

Source: SUNALERT
Type: Patch, Vendor Advisory
51980

Source: CCN
Type: US-CERT VU#944241
rpc.walld fails to properly validate messages before broadcasting to clients

Source: CERT-VN
Type: Exploit, Third Party Advisory, US Government Resource
VU#944241

Source: CCN
Type: OSVDB ID: 15141
Solaris rpc.walld Local Message Spoofing

Source: BUGTRAQ
Type: Exploit, Vendor Advisory
20030103 Solaris 2.x /usr/sbin/wall Advisory

Source: BID
Type: UNKNOWN
6509

Source: CCN
Type: BID-6509
Sun Solaris Wall Spoofed Message Origin Vulnerability

Source: SECTRACK
Type: UNKNOWN
1005882

Source: SECTRACK
Type: UNKNOWN
1006682

Source: XF
Type: UNKNOWN
solaris-wall-message-spoofing(11608)

Source: XF
Type: UNKNOWN
solaris-wall-message-spoofing(11608)

Vulnerable Configuration:

Configuration 1:

cpe:/o:sun:solaris:2.5.1:*:x86:*:*:*:*:*

OR cpe:/o:sun:sunos:5.6:*:*:*:*:*:*:*

OR cpe:/o:sun:solaris:7.0:*:x86:*:*:*:*:*

OR cpe:/o:sun:solaris:8.0:*:x86:*:*:*:*:*

OR cpe:/o:sun:solaris:9.0:*:sparc:*:*:*:*:*

OR cpe:/o:sun:sunos:-:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.5.1:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.7:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.8:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:sun:solaris:2.5.1::ppc:*:*:*:*:*

OR cpe:/o:sun:solaris:2.6::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:8::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:7.0::sparc:*:*:*:*:*

Denotes that component is vulnerable