N/A

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMB_IOC_SVCENUM IOCTL. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4983.

N/A

堆缓冲区溢出

Joyent SmartOS 缓冲区错误漏洞

Joyent SmartOS是美国Joyent公司的一套开源的操作系统。 Joyent SmartOS release-20170803-20170803T064301Z版本中的SMBIOC_TREE_RELE ioctl存在安全漏洞，该漏洞源于程序没有正确的检测用户提交的数据，导致复制数据的大小超过基于堆的固定长度的缓冲区。本地攻击者可利用该漏洞提升权限，执行代码。

N/A

N/A