CVE-2006-4842

Netscape Portable Runtime (NSPR) API <4.6.3 - Local File Creation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 7 public exploits for CVE-2006-4842. PoCs published by Metasploit, Marco Ivaldi, iDefense, Marco Ivaldi, bcoles, including Metasploit module exploits/solaris/local/libnspr_nspr_log_file_priv_esc.

AI-analyzed exploit summary This Metasploit module exploits CVE-2006-4842, a privilege escalation vulnerability in Solaris libnspr (NSPR_LOG_FILE) by writing a shared object to a trusted directory and leveraging an SUID binary to gain root privileges.

Description

The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.

Exploits (7)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalsolaris
https://www.exploit-db.com/exploits/45433

This Metasploit module exploits CVE-2006-4842, a privilege escalation vulnerability in Solaris libnspr (NSPR_LOG_FILE) by writing a shared object to a trusted directory and leveraging an SUID binary to gain root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Solaris libnspr versions prior to 4.6.3 (Solaris 10u1 and 10u2)
No auth needed
Prerequisites: SUID binary linked to vulnerable libnspr · gcc installed · writable directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Marco Ivaldi · bashlocalsolaris
https://www.exploit-db.com/exploits/28789

This exploit leverages a design error in NSPR (CVE-2006-4842) on Solaris 10, where environment variables are used to create log files with elevated privileges. It creates a malicious shared library with a constructor that spawns a root shell when loaded by a setuid binary.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Netscape Portable Runtime API (NSPR) 4.6.1 on Solaris 10
No auth needed
Prerequisites: Solaris 10 without patch 119213-10 (SPARC) or 119214-10 (x86) · gcc compiler · access to a setuid binary linked to libnspr4.so
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Marco Ivaldi · bashlocalsolaris
https://www.exploit-db.com/exploits/2641

This exploit leverages a design error in NSPR (CVE-2006-4842) on Solaris 10 to create or overwrite arbitrary files with elevated privileges. It uses environment variables to manipulate log file creation and a shared library with a constructor to execute arbitrary code as root.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Sun Microsystems Solaris 10 with NSPR 4.6.1
No auth needed
Prerequisites: Access to a vulnerable Solaris 10 system · GCC to compile the shared library
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Marco Ivaldi · bashlocalsolaris
https://www.exploit-db.com/exploits/2569

This exploit leverages a design error in NSPR (CVE-2006-4842) on Solaris 10, where environment variables are used to create log files with elevated privileges. It compiles a malicious shared library to override `getuid()` and escalates privileges via `LD_PRELOAD`.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Sun Microsystems Solaris 10 (NSPR 4.6.1)
No auth needed
Prerequisites: Solaris 10 without patch 119213-10 (SPARC) or 119214-10 (x86) · gcc compiler available · access to a setuid binary linked to libnspr4.so
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Marco Ivaldi · bashlocalsolaris
https://www.exploit-db.com/exploits/28788

This exploit leverages a design error in the Netscape Portable Runtime (NSPR) API on Solaris 10, where environment variables are used to create log files with elevated privileges. By manipulating the NSPR_LOG_FILE variable, an attacker can overwrite arbitrary files (e.g., /.rhosts) to gain root access via rsh.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Netscape Portable Runtime (NSPR) 4.6.1 on Solaris 10
No auth needed
Prerequisites: Access to a vulnerable Solaris 10 system · Presence of setuid binaries linked to libnspr4.so
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Marco Ivaldi · bashlocalsolaris
https://www.exploit-db.com/exploits/2543

This exploit leverages a design error in NSPR (CVE-2006-4842) on Solaris 10, where environment variables control log file creation, allowing arbitrary file writes with elevated privileges. It abuses setuid binaries to overwrite /.rhosts and gain root access via rsh.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: NSPR 4.6.1 on Solaris 10
No auth needed
Prerequisites: Solaris 10 without patches 119213-10 (SPARC) or 119214-10 (x86) · Access to a vulnerable setuid binary linked to libnspr4.so
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by iDefense, Marco Ivaldi, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/local/libnspr_nspr_log_file_priv_esc.rb

This Metasploit module exploits a privilege escalation vulnerability in Solaris libnspr (CVE-2006-4842) by leveraging the NSPR_LOG_FILE environment variable to create arbitrary files with elevated privileges. It writes a shared object to a trusted library directory and executes a SUID binary to gain root access.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Solaris libnspr versions prior to 4.6.3
No auth needed
Prerequisites: Unpatched Solaris system prior to Solaris 10u3 · Presence of a SUID binary linked to vulnerable libnspr · GCC installed for compilation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (10)

Core 10
Core References
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20471
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4016
Vendor Advisory third-party-advisory x_refsource_idefense
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/448691/100/0/threaded
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45433/
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/29489
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22348
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1819
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1017050

Scores

EPSS 0.1138
EPSS Percentile 93.7%

Details

CWE
CWE-20
Status published
Products (3)
netscape/portable_runtime_api 4.6.1
netscape/portable_runtime_api 4.6.2
sun/solaris 10.0
Published Oct 12, 2006
Tracked Since Feb 18, 2026