PT-2009-3464 · Sun · Sun Solaris+1

Publicado 2009-03-11 · Atualizado 2017-08-17 · CVE-2009-0872

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Solaris versions 10 OpenSolaris versions prior to snv 111

Description The issue concerns the NFS server's improper implementation of the AUTH NONE security mode when combined with other security modes. This allows remote attackers to bypass access restrictions, enabling them to read or modify files. An example of this vulnerability is when AUTH NONE is used in combination with AUTH SYS.

Recommendations For Sun Solaris 10, consider restricting access to the NFS server until a proper fix is applied. For OpenSolaris versions prior to snv 111, update to a version after snv 111 to resolve the issue. As a temporary workaround, consider disabling the use of the AUTH NONE security mode in combination with other modes until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0872

Produtos afetados

Opensolaris

Sun Solaris

Referências · 12

• 🔥 http://securityfocus.com/bid/34063 · Exploit
• http://secunia.com/advisories/34213 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1 · Correção
• http://securitytracker.com/id?1021833 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0872 · Nota de Segurança
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253588-1 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49170 · Nota
• http://secunia.com/advisories/34429 · Nota
• http://vupen.com/english/advisories/2009/0658 · Aviso do Fabricante
• http://support.avaya.com/elmodocs2/security/ASA-2009-093.htm · Nota
• http://osvdb.org/52559 · Nota
• http://vupen.com/english/advisories/2009/0798 · Nota