CVE-2003-0722
Solaris - Unauthenticated Remote Privilege Escalation via sadmind AUTH_SYS Spoofing
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2003-0722.
PoCs published by Metasploit, H D Moore, including Metasploit module exploits/solaris/sunrpc/sadmind_exec.
AI-analyzed exploit summary This exploit targets a vulnerability in the Solaris sadmind RPC service (CVE-2003-0722) by leveraging weak default security settings to execute arbitrary commands. It uses SunRPC authentication and crafts a malicious request to spawn a shell.
Description
The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets.
Exploits (3)
This exploit targets a vulnerability in the Solaris sadmind RPC service (CVE-2003-0722) by leveraging weak default security settings to execute arbitrary commands. It uses SunRPC authentication and crafts a malicious request to spawn a shell.
This exploit targets a vulnerability in Solaris sadmind RPC service (CVE-2003-0722) by forging RPC packets to execute arbitrary commands with root privileges. It leverages weak AUTH_SYS authentication to bypass security checks and execute commands via directory traversal.
This Metasploit module exploits a vulnerability in the Solaris sadmind RPC service (CVE-2003-0722) by sending a maliciously crafted request to execute arbitrary commands via a shell. It leverages weak default security settings in Sun Solstice AdminSuite to achieve remote code execution.