(Sun Issues Fix for Solaris and Linux) NVIDIA Binary Graphics Driver for Linux Buffer Overflow Lets Local Users Gain Root Privileges
|
|
SecurityTracker Alert ID: 1017154 |
|
SecurityTracker URL: http://securitytracker.com/id/1017154
|
|
CVE Reference:
CVE-2006-5379
(Links to External Site)
|
Date: Nov 3 2006
|
Impact:
Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in the NVIDIA Binary Graphics Driver for Linux. A local user can obtain elevated privileges on the target system.
A local user can trigger a buffer overflow to execute arbitrary code with root privileges on the target system.
A remote authenticated user (via X) can also exploit this vulnerability.
The closed-source version of the driver is affected.
The NVIDIA Driver for FreeBSD and for Solaris may also be affected.
Derek Abdine of Rapid7 discovered this vulnerability.
The original advisory is available at:
http://www.rapid7.com/advisories/R7-0025.jsp
|
Impact:
A local user can obtain root privileges on the target system.
|
Solution:
Sun has issued the following fixes.
x86/x64 Platforms
* Nvidia Graphics Driver (for Solaris 10) version 1.0-8776
Linux Platform
* Nvidia Graphics Driver version 1.0-8776
The 1.2 "Tools and Drivers" CD for the Ultra 20 M2, the 1.5a Supplemental CD for the Ultra 20, and the 1.4a "Tools and Drivers" CD for the Ultra 40 contain the 1.0-8776 drivers. They are available at:
Ultra 20, Ultra 20M2:
http://www.sun.com/desktop/workstation/ultra20/downloads.jsp
Ultra 40:
http://www.sun.com/desktop/workstation/ultra40/downloads.jsp
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102693-1
|
Vendor URL: www.nvidia.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Sun), UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 3 Nov 2006 00:47:13 -0500
Subject: Security Vulnerability With Graphics Driver for Solaris 10 and Linux on Certain Systems
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102693-1
CVE-2006-5379
|
|
