PT-2004-2309 · Sun · Sun Solaris

Publicado 2004-12-31 · Atualizado 2018-10-30 · CVE-2004-1394

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Sun Solaris versions 8 and 9

Description: The issue arises from the pfexec function's improper handling of custom profiles with invalid entries in the exec attr database. This may allow local users with custom rights profiles to execute profile commands with elevated privileges.

Recommendations: For Sun Solaris versions 8 and 9, ensure that all custom profiles contain valid entries in the exec attr database to prevent potential privilege escalation. As a temporary workaround, consider restricting access to custom profiles until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-1394

Produtos afetados

Sun Solaris

Referências · 8

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57453-1 · Aviso do Fabricante
• http://auscert.org.au/render.html?it=3800 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14988 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1394 · Nota de Segurança
• http://secunia.com/advisories/10755 · Correção
• http://securityfocus.com/bid/9534 · Nota
• http://osvdb.org/3764 · Nota
• http://securitytracker.com/id?1008893 · Nota