CVE-2003-0027

Sun Solaris - Directory Traversal via KCMS KCS_OPEN_PROFILE Procedure

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-0027. Includes Metasploit module auxiliary/admin/sunrpc/solaris_kcms_readfile.

AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in Solaris KCMS and TTDB servers to read arbitrary files. It uses SunRPC calls to bypass validation and retrieve file contents.

Description

Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.

Exploits (1)

metasploit WORKING POC

rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb

View Code ZIP pw:eip

This Metasploit module exploits a directory traversal vulnerability in Solaris KCMS and TTDB servers to read arbitrary files. It uses SunRPC calls to bypass validation and retrieve file contents.

Classification

Working Poc 95%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Reliable

Target: Solaris 2.5 - 9 (SPARC/x86) with kcms_server and rpc.ttdbserverd running

No auth needed

Prerequisites: kcms_server and rpc.ttdbserverd must be running on the target · Network access to TCP ports 100221 and 100083

MITRE ATT&CK