CVE-2006-4842: Input Validation

Published Oct 12, 2006

Updated

The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.

Affected Software

3 affected components

Netscape Portable Runtime Api=4.6.2

Netscape Portable Runtime Api=4.6.1

Sun Solaris=10.0

Event History

Oct 12, 2006

CVE Published

12:07 AM

Data Sourced

via NVD·12:07 AM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4842?

CVE-2006-4842 has a medium severity rating, allowing local users to potentially overwrite files due to improper handling of environment variables.

How do I fix CVE-2006-4842?

To fix CVE-2006-4842, avoid trusting user-specified environment variables for log file locations, especially in setuid programs.

Which software versions are affected by CVE-2006-4842?

CVE-2006-4842 affects Netscape Portable Runtime API versions 4.6.1 and 4.6.2, as well as Oracle Solaris 10.

Who can exploit CVE-2006-4842?

CVE-2006-4842 can be exploited by local users who have access to setuid programs.

What kind of vulnerabilities does CVE-2006-4842 represent?

CVE-2006-4842 represents a local file overwrite vulnerability due to improper validation of user-specified environment variables.