CVE-2003-0834
SCO Open UNIX and UnixWare - Buffer Overflow via DTHELPUSERSEARCHPATH or DTSEARCHPATH Environment Variable
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2003-0834. PoCs published by Marco Ivaldi.
AI-analyzed exploit summary This exploit targets a buffer overflow in the CDE libDtHelp library (CVE-2003-0834) on Solaris/SPARC systems, leveraging environment variables like DTHELPSEARCHPATH to execute arbitrary code via a ret-into-ld.so technique, bypassing non-executable stack protections.
Description
Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary code via (1) a modified DTHELPUSERSEARCHPATH environment variable and the Help feature, (2) DTSEARCHPATH, or (3) LOGNAME.
Exploits (2)
This exploit targets a buffer overflow in the CDE libDtHelp library (CVE-2003-0834) on Solaris/SPARC systems, leveraging environment variables like DTHELPSEARCHPATH to execute arbitrary code via a ret-into-ld.so technique, bypassing non-executable stack protections.
This exploit leverages a buffer overflow in the CDE libDtHelp library via the DTHELPSEARCHPATH environment variable to achieve local privilege escalation on Solaris/SPARC systems. It uses a carefully crafted environment and shellcode to execute arbitrary commands as root.