Loading vulnerability…
CVE-2019-3010 is a local privilege escalation vulnerability in the xscreensaver utility as distributed with Oracle Solaris 11.x. The flaw is due to a design error in the handling of the '-log' command line switch (introduced in version 5.06), which allows local attackers to create or append to arbitrary files on the system. By exploiting this, an attacker can write a malicious shared object to a sensitive directory and use LD_PRELOAD to escalate privileges to root. The vulnerability is specific to Oracle's Solaris codebase and does not affect upstream xscreensaver. The exploit requires local access and the presence of gcc to compile the payload. The vulnerability was disclosed by Marco Ivaldi and affects both x86 and SPARC (untested) platforms running Solaris 11.3 and 11.4.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module: 'modules/exploits/solaris/local/xscreensaver_log_priv_esc.rb'. The module exploits a local privilege escalation vulnerability (CVE-2019-3010) in xscreensaver (versions 5.06 to 5.41) on unpatched Solaris 11 systems. The vulnerability allows a local user to create a file at an arbitrary location via the '-log' argument, which is then overwritten with a malicious shared object. The exploit uses LD_PRELOAD to execute this shared object as root, which in turn runs a payload (typically a shell) with root privileges. The module is weaponized, supporting customizable payloads via the Metasploit framework. The main endpoints involved are the xscreensaver and Xorg binaries, the /usr/lib/secure/ directory (where the malicious file is placed), and /tmp for temporary files. The exploit requires local access to the target system and is not remotely exploitable. The code is well-structured, leverages Metasploit's APIs, and includes checks for vulnerable versions and required system configuration.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.