CVE-2008-4556: Sun Solaris sadmind adm_build_path stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a complete-impact CVSS 2.0 score of 10 and public exploit references makes this a critical exposure wherever sadmind is reachable.

What it is

The adm_build_path function in sadmind, part of Sun Solstice AdminSuite on Solaris 8 and 9, contains a stack-based buffer overflow (CWE-119) reachable through a crafted request. Because sadmind is a network-facing service, a successful overflow can lead to remote code execution with the privileges of the daemon. The record does not list specific affected patch levels or build versions beyond Solaris 8 and 9.

Impact

An unauthenticated remote attacker can execute arbitrary code on the target host, potentially gaining full control of the system. Given the CVSS 2.0 vector (AV:N/AC:L/Au:N/C:C/I:C/A:C), the impact is complete compromise of confidentiality, integrity and availability.

Attack surface

The flaw is reached over the network via a crafted request to the sadmind service; the CVSS vector indicates no authentication (Au:N) and low attack complexity (AC:L). No user interaction is required per the vector and description.

Exploitation

The record is not listed in CISA KEV, but EPSS is high (0.69862, 99.3rd percentile) and multiple references are tagged Exploit, including RISE-2008001 and SecurityFocus BID 31751, indicating public exploit material exists.

What to do

• Apply the Sun/Solaris vendor patch referenced in SunSolve document 245806 (or later equivalent) as the first action.
• If sadmind is not required, disable or stop the sadmind service and block TCP/UDP port 111 (rpcbind) and sadmind's RPC port at the network perimeter.
• Restrict network access to sadmind to trusted management hosts only, using host-based firewalls or network ACLs.
• Upgrade or migrate off Solaris 8 and 9, which are long past end of life and no longer receive security fixes.
• Monitor vendor and Avaya advisories (ASA-2008-448) for any backported fixes if the platform is still in use.

Detection

• Inspect sadmind and rpcbind logs for malformed or unusually long requests, crashes, or restarts of the sadmind process.
• Use host IDS/IPS or network monitoring to alert on exploit traffic targeting sadmind RPC ports, referencing signatures for CVE-2008-4556.
• Check for unexpected child processes, shell spawning, or outbound connections originating from the sadmind service account.
• Audit systems for the presence of sadmind and confirm whether the vendor patch has been applied.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.