CVE-2007-2617

Sun Remote Services Net Connect Software - Unauthenticated Arbitrary File Read via srsexec Options

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2617. PoCs published by anonymous.

AI-analyzed exploit summary This exploit leverages a design error in Sun Microsystems Solaris to disclose sensitive information, including superuser password hashes from /etc/shadow, by invoking the srsexec binary with specific arguments.

Description

srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options.

Exploits (1)

exploitdb WORKING POC VERIFIED

by anonymous · textlocalsolaris

https://www.exploit-db.com/exploits/30021

View Code ZIP pw:eip

This exploit leverages a design error in Sun Microsystems Solaris to disclose sensitive information, including superuser password hashes from /etc/shadow, by invoking the srsexec binary with specific arguments.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Sun Microsystems Solaris (specific version not specified)

No auth needed

Prerequisites: Local access to the target system · Presence of /opt/SUNWsrspx/bin/srsexec binary

MITRE ATT&CK