PT-2018-1384 · Oracle · Solaris Cluster

Publicado 2018-07-17 · Atualizado 2019-10-03 · CVE-2018-2930

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Sun Systems Products Suite versions 3.3 and 4.3

Description The issue is related to inadequate access control in the NAS device addition component of the Solaris Cluster, allowing an unauthenticated attacker with network access via RPC to compromise the Solaris Cluster. Successful exploitation can result in the takeover of the Solaris Cluster.

Recommendations For version 3.3, update to a fixed version to prevent exploitation. For version 4.3, update to a fixed version to prevent exploitation. As a temporary workaround, consider restricting access to the RPC protocol to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2018-00929

CVE-2018-2930

Produtos afetados

Solaris Cluster

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-2930 · Aviso do Fabricante
• http://securityfocus.com/bid/104777 · Nota
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2930 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00929 · Nota de Segurança
• http://securitytracker.com/id/1041303 · Nota