CVE-2003-1055

Solaris 8 and 9 - Buffer Overflow in nss_ldap.so.1 via Long Hostname

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-1055. PoCs published by Andi.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Solaris LDAP client (CVE-2003-1055) to achieve local privilege escalation. It uses a crafted buffer with NOP sleds and shellcode to spawn a root shell via the 'ping' command.

Description

Buffer overflow in the nss_ldap.so.1 library for Sun Solaris 8 and 9 may allow local users to gain root access via a long hostname in an LDAP lookup.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Andi · clocalsolaris

https://www.exploit-db.com/exploits/4

View Code ZIP pw:eip

This exploit targets a buffer overflow vulnerability in Solaris LDAP client (CVE-2003-1055) to achieve local privilege escalation. It uses a crafted buffer with NOP sleds and shellcode to spawn a root shell via the 'ping' command.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Solaris LDAP client (pre-patch 108994-11)

No auth needed

Prerequisites: Access to a vulnerable Solaris system · Ability to execute the compiled binary

MITRE ATT&CK