COMMAND

    popper

SYSTEMS AFFECTED

    Solaris 2.4

PROBLEM

    Julio Casal posted following.  Solaris 2.4 popper has an  overflow
    in the username explotaible obviously as root.  It's also easy  to
    get root's shadow entry in the core dumped just failing to log  as
    root before overruning  the username.   Depending on the  revision
    level of 2.4 the dump will  follow symolic and hard links, so  why
    wait to crack the root password when you can slam a few files  and
    get a full fledged uid of  0. core() is wack in pre  2.5.1(may 96)
    versions.

    It is unclear yet about this SUNWpop from where it comes (an extra
    with first Netra servers, SIMS 1.0/2.0 which has imap4/pop3, etc).

SOLUTION

    Nothing yet.  You  should replace it with  latest one from Sun  or
    some other vendor.