PT-2004-2309 · Sun · Sun Solaris

Published 2004-12-31 · Updated 2018-10-30 · CVE-2004-1394

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Sun Solaris versions 8 and 9

Description: The issue arises from the pfexec function's improper handling of custom profiles with invalid entries in the exec attr database. This may allow local users with custom rights profiles to execute profile commands with elevated privileges.

Recommendations: For Sun Solaris versions 8 and 9, ensure that all custom profiles contain valid entries in the exec attr database to prevent potential privilege escalation. As a temporary workaround, consider restricting access to custom profiles until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-1394

Affected Products

Sun Solaris

References · 8

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57453-1 · Vendor Advisory
• http://auscert.org.au/render.html?it=3800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1394 · Security Note
• http://secunia.com/advisories/10755 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14988 · Note
• http://securityfocus.com/bid/9534 · Note
• http://osvdb.org/3764 · Note
• http://securitytracker.com/id?1008893 · Note