PT-2017-2671 · Oracle · Solaris

Publicado 2017-07-18 · Atualizado 2019-10-03 · CVE-2017-10042

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Sun Systems Products Suite (Solaris component) versions 10 and 11

Description The issue is related to a vulnerability in the IKE protocol of the Solaris operating system, which is associated with inadequate access control. This vulnerability can be easily exploited by an unauthenticated attacker with network access via IKE, allowing them to compromise Solaris. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of Solaris.

Recommendations For versions 10 and 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the IKE protocol to minimize the risk of exploitation.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2017-01899

CVE-2017-10042

Produtos afetados

Solaris

Referências · 6

• https://bdu.fstec.ru/vul/2017-01899 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-10042 · Aviso do Fabricante
• http://securityfocus.com/bid/99838 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-10042 · Nota de Segurança
• http://securitytracker.com/id/1038938 · Nota