ex_inc.c exploits a bounds checking error in /usr/jp/bin/mh/inc which was distributed with the mh-6.8.3 package. Local root compromise.
72428b901f7f45c05e3c1b5048f8275eex_bbc.c exploits a bounds checking error in /usr/jp/bin/mh/bbc which was distributed with the mh-6.8.3 package. Local root compromise.
a5b2d66a75247c7d8c9cb5c5bceb2ce4kcms_configure has a overflow bug with "-P" option and it has been reported(107339-01). But this program has another hole. This hole has not been not reported, and the paches are not published at this time. kcms_configure overflows if long string is specified in NETPATH environment, and it is exploitable. I have included an exploit for Solaris7 intel edition to obtain root privilege.
96891067efbb4ca666ca294943ae33b0The vulnerability in kcms_configure also exists in Solaris 2.6 and 2.7 sparc edition. Exploit included.
e2e854ae8bed8bd41d390b8b8c6423e1The mailer programs (mailtool and dtmail) and mail message print filter (dtmailpr) which are installed on Solaris7 have exploitable buffer overflow bugs. These programs are sgid (mail group) programs, local user can obtain mail group. The mail files are generated with 660 permission, so any user can read/write other user's mail files. I coded the exploits to get mail gid(egid=6). There are for Intel Solaris7. There are same kind of problems on Sparc Solaris7 and Solaris2.6 (Intel,Sparc).
68399227ff709fd06cd83d967dcf842aAdmintool local root exploit for Solaris2.6/7 Sparc machines.
68f7d2c4497e4f6766f8db1c517c1ac3Local root exploit code for buffer overflow in canuum for Japanese Linux.
08d584cfaedebba6322e15ff0bc6ae6eExploit code for Solaris 2.6, 2.7 (sparc) libc/LC_MESSAGES buffer overflow that results in root compromise.
e1ab7379ca0d6ddacf82ca872b94caa4Local root exploit for buffer overflow condition in sdtcm_convert, for Solaris Sparc machines.
87ad1fbf6788465fdf86d444b37bf205Local root exploit for buffer overflow condition in sdtcm_convert, for Solaris x86 machines.
d955ef3f946bcdff24e790deb5daf06aLocal root exploit code for buffer overflow in uum for Japanese Linux.
863a7d14785073101a7d49dd62001678