PT-2017-2672 · Oracle · Solaris

Publicado 2017-07-18 · Atualizado 2019-10-03 · CVE-2017-10036

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Sun Systems Products Suite (Solaris component) versions 10 and 11

Description The issue is related to a vulnerability in the NFSv4 protocol of the Solaris operating system, which is associated with inadequate access control. This vulnerability can be easily exploited by an unauthenticated attacker with network access via NFSv4, allowing them to compromise Solaris. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of Solaris.

Recommendations For versions 10 and 11, consider restricting access to the NFSv4 protocol to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the NFSv4 service until a fix is provided.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2017-01900

CVE-2017-10036

Produtos afetados

Solaris

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-10036 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-01900 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Aviso do Fabricante
• http://securityfocus.com/bid/99840 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-10036 · Nota de Segurança
• http://securitytracker.com/id/1038938 · Nota