CVE-2006-3824 (GCVE-0-2006-3824)

Vulnerability from cvelistv5 – Published: 2006-07-25 00:00 – Updated: 2024-08-07 18:48
VLAI
Summary
systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness error or integer underflow.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://securitytracker.com/id?1016555 vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/440849/100… mailing-listx_refsource_BUGTRAQ
http://www.vupen.com/english/advisories/2006/2936 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/21148 third-party-advisoryx_refsource_SECUNIA
http://www.idefense.com/intelligence/vulnerabilit… third-party-advisoryx_refsource_IDEFENSE
http://www.securityfocus.com/bid/19104 vdb-entryx_refsource_BID
http://sunsolve.sun.com/search/document.do?assetk… vendor-advisoryx_refsource_SUNALERT
http://www.securityfocus.com/archive/1/440986/100… mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Date Public
2006-07-21 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T18:48:38.009Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1016555",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1016555"
          },
          {
            "name": "20060721 Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/440849/100/100/threaded"
          },
          {
            "name": "ADV-2006-2936",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/2936"
          },
          {
            "name": "21148",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21148"
          },
          {
            "name": "20060720 Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
            "tags": [
              "third-party-advisory",
              "x_refsource_IDEFENSE",
              "x_transferred"
            ],
            "url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?id=410"
          },
          {
            "name": "19104",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/19104"
          },
          {
            "name": "102343",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102343-1"
          },
          {
            "name": "20060724 Re: Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/440986/100/100/threaded"
          },
          {
            "name": "solaris-systeminfo-overflow(27901)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27901"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-07-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function.  NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness error or integer underflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "1016555",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1016555"
        },
        {
          "name": "20060721 Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/440849/100/100/threaded"
        },
        {
          "name": "ADV-2006-2936",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/2936"
        },
        {
          "name": "21148",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21148"
        },
        {
          "name": "20060720 Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
          "tags": [
            "third-party-advisory",
            "x_refsource_IDEFENSE"
          ],
          "url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?id=410"
        },
        {
          "name": "19104",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/19104"
        },
        {
          "name": "102343",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102343-1"
        },
        {
          "name": "20060724 Re: Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/440986/100/100/threaded"
        },
        {
          "name": "solaris-systeminfo-overflow(27901)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27901"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-3824",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function.  NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness error or integer underflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1016555",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1016555"
            },
            {
              "name": "20060721 Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/440849/100/100/threaded"
            },
            {
              "name": "ADV-2006-2936",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/2936"
            },
            {
              "name": "21148",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21148"
            },
            {
              "name": "20060720 Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
              "refsource": "IDEFENSE",
              "url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?id=410"
            },
            {
              "name": "19104",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/19104"
            },
            {
              "name": "102343",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102343-1"
            },
            {
              "name": "20060724 Re: Re: [Full-disclosure] iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/440986/100/100/threaded"
            },
            {
              "name": "solaris-systeminfo-overflow(27901)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27901"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-3824",
    "datePublished": "2006-07-25T00:00:00.000Z",
    "dateReserved": "2006-07-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T18:48:38.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2006-3824",
      "date": "2026-09-21",
      "epss": "0.00985",
      "percentile": "0.60355"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:*",
                    "matchCriteriaId": "7BF232A9-9E0A-481E-918D-65FC82EF36D8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sun:solaris:10.0:*:x86:*:*:*:*:*",
                    "matchCriteriaId": "0C0C3793-E011-4915-8F86-CE622A2D37D1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function.  NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness error or integer underflow."
          },
          {
            "lang": "es",
            "value": "systeminfo.c para Sun Solaris permite a usuarios locales leer memoria del n\u00facleo mediante un valor 0 para el argumento de n\u00famero de variables en la llamada al sistema sysinfo, lo cual provoca que se utilice un argumento -1 en la funci\u00f3n copyout. NOTA: este problema ha sido referido como un desbordamiento superior de entero, pero probablemente se parece m\u00e1s a un error de presencia de signo o un desbordamiento inferior de entero."
          }
        ],
        "evaluatorSolution": "This vulnerability is addressed in the following product releases:\r\nSun, Solaris, 10_x86 patch 118833-09 or later\r\nSun, Solaris, 10 patch 118855-06 or later\r\n",
        "id": "CVE-2006-3824",
        "lastModified": "2026-04-16T00:27:16.627",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 4.9,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "NONE",
                "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2006-07-25T13:22:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/21148"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securitytracker.com/id?1016555"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102343-1"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?id=410"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/440849/100/100/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/440986/100/100/threaded"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Patch"
            ],
            "url": "http://www.securityfocus.com/bid/19104"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2006/2936"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27901"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/21148"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securitytracker.com/id?1016555"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102343-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?id=410"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/440849/100/100/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/440986/100/100/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Patch"
            ],
            "url": "http://www.securityfocus.com/bid/19104"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2006/2936"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27901"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.