{"id":"CVE-2006-4842","url":"https://www.cyber-defence.io/tools/cve/CVE-2006-4842","generatedAt":"2026-10-27T18:43:43.115Z","title":"The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary…","description":"The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.","published":"2006-10-12T00:07:00.000Z","lastModified":"2026-06-16T22:29:53.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":3.6,"severity":"LOW","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P"},"cwe":["CWE-20"],"affected":["netscape/portable runtime api","sun/solaris"],"epss":{"score":0.07621,"percentile":0.94521,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":6,"verified":true,"firstPublished":"2006-10-13","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":45433,"kind":"exploit","title":"Solaris - libnspr NSPR_LOG_FILE Privilege Escalation (Metasploit)","url":"https://www.exploit-db.com/exploits/45433","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/solaris/local/45433.rb","file":"exploits/solaris/local/45433.rb","published":"2018-09-18","added":"2018-09-18","updated":"2018-09-18","author":"Metasploit","type":"local","platform":"solaris","port":null,"verified":true,"codes":["CVE-2006-4842"],"tags":"Local","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://raw.githubusercontent.com/rapid7/metasploit-framework/5089c194538accac4b9d5e3ed14b66129aa1527e/modules/exploits/solaris/local/libnspr_nspr_log_file_priv_esc.rb"},{"edbId":28789,"kind":"exploit","title":"Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (2)","url":"https://www.exploit-db.com/exploits/28789","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/solaris/local/28789.sh","file":"exploits/solaris/local/28789.sh","published":"2006-10-24","added":"2006-10-24","updated":"2013-10-08","author":"Marco Ivaldi","type":"local","platform":"solaris","port":null,"verified":true,"codes":["CVE-2006-4842","OSVDB-29610"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20471/info"},{"edbId":2641,"kind":"exploit","title":"Solaris 10 libnspr - 'Constructor' Arbitrary File Creation Privilege Escalation (3)","url":"https://www.exploit-db.com/exploits/2641","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/solaris/local/2641.sh","file":"exploits/solaris/local/2641.sh","published":"2006-10-24","added":"2006-10-23","updated":"2016-11-14","author":"Marco Ivaldi","type":"local","platform":"solaris","port":null,"verified":true,"codes":["CVE-2006-4842"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":2569,"kind":"exploit","title":"Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (2)","url":"https://www.exploit-db.com/exploits/2569","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/solaris/local/2569.sh","file":"exploits/solaris/local/2569.sh","published":"2006-10-16","added":"2006-10-15","updated":"2016-11-14","author":"Marco Ivaldi","type":"local","platform":"solaris","port":null,"verified":true,"codes":["CVE-2006-4842"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":28788,"kind":"exploit","title":"Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (1)","url":"https://www.exploit-db.com/exploits/28788","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/solaris/local/28788.sh","file":"exploits/solaris/local/28788.sh","published":"2006-10-13","added":"2006-10-13","updated":"2013-10-08","author":"Marco Ivaldi","type":"local","platform":"solaris","port":null,"verified":true,"codes":["CVE-2006-4842","OSVDB-29610"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20471/info"},{"edbId":2543,"kind":"exploit","title":"Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (1)","url":"https://www.exploit-db.com/exploits/2543","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/solaris/local/2543.sh","file":"exploits/solaris/local/2543.sh","published":"2006-10-13","added":"2006-10-12","updated":"2016-11-14","author":"Marco Ivaldi","type":"local","platform":"solaris","port":null,"verified":true,"codes":["CVE-2006-4842"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"high","text":"6 public exploits are published in Exploit-DB (verified), so the technical barrier is gone even though the severity is low and EPSS is 7.6%. Treat it as high on anything reachable from the internet."},"changes":[],"references":[{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/22348","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1017050","source":"cve@mitre.org"},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/448691/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/20471","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/4016","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/29489","source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1819","source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/45433/","source":"cve@mitre.org"},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/22348","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1017050","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/448691/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/20471","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/4016","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/29489","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1819","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/45433/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-4842","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}