PT-2001-2508 · Oracle · Solaris

Published 2001-10-09 · Updated 2018-10-30 · CVE-2001-1414

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Solaris versions 2.5.1, 2.6, 7, and 8

Description The issue concerns the Basic Security Module (BSM) for Solaris, which fails to log anonymous FTP access. This allows remote attackers to conceal their activities, particularly when specific BSM audit files are missing under the FTP root.

Recommendations For Solaris versions 2.5.1, 2.6, 7, and 8, consider configuring the BSM to log anonymous FTP access or implement an alternative auditing mechanism to monitor FTP activities. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1414

Affected Products

Solaris

References · 4

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-40521-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1414 · Security Note
• http://securityfocus.com/bid/7396 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11841 · Note