CVE-1999-0209
SunOS - Unauthenticated Arbitrary File Read via SunView Selection Service
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-1999-0209.
PoCs published by Metasploit, I)ruid, Peter Shipley, including Metasploit module exploits/solaris/sunrpc/ypupdated_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Solaris ypupdated via RPC, allowing remote command execution as root by appending commands to a MAP UPDATE request.
Description
The SunView (SunTools) selection_svc facility allows remote users to read files.
Exploits (4)
This Metasploit module exploits a command injection vulnerability in Solaris ypupdated via RPC, allowing remote command execution as root by appending commands to a MAP UPDATE request.
This is a Metasploit module exploiting CVE-1999-0209, a command injection vulnerability in Solaris ypupdated. It sends a crafted MAP UPDATE request with a payload in the format '|<command>' to execute arbitrary commands as root.
This exploit leverages a vulnerability in SunView's selection_svc process, which persists after the user quits SunView, allowing remote systems to read files accessible to the last user who ran SunView. The PoC demonstrates how to hold a file for selection, enabling unauthorized file access.
This Metasploit module exploits a command injection vulnerability in Solaris ypupdated (CVE-1999-0209) by sending a malicious MAP UPDATE request via SunRPC, allowing arbitrary command execution as root.