PT-2009-6421 · Oracle · Sun Ray 1+3

Publicado 2009-12-11 · Atualizado 2009-12-14 · CVE-2009-4295

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Ray Server Software versions 4.0 through 4.1

Description The issue allows remote attackers to obtain sensitive information by predicting a key and then using it to decrypt sniffed network traffic, due to the lack of unique DSA private key generation for the firmware on each Sun Ray device.

Recommendations For Sun Ray Server Software versions 4.0 through 4.1, consider regenerating a unique DSA private key for the firmware on each Sun Ray 1, 1g, 100, and 150 DTU device to prevent remote attackers from predicting a key and decrypting network traffic.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-4295

Produtos afetados

Sun Ray 1

Sun Ray 100

Sun Ray 150

Sun Ray Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-4295 · Nota de Segurança
• http://vupen.com/english/advisories/2009/3477 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270549-1 · Aviso do Fabricante
• http://securityfocus.com/bid/37285 · Correção
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-07-1 · Correção