PT-2007-4963 · Sun · Sun Solaris

Published 2007-07-12 · Updated 2018-10-30 · CVE-2007-3717

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Solaris versions 8, 9, and 10 before 20070710

Description The issue is related to the rcp command on Sun Solaris, which does not properly call certain helper applications. This allows local users to gain privileges by creating files with specific names, possibly containing shell metacharacters or spaces.

Recommendations For Sun Solaris versions 8, 9, and 10 before 20070710, update to a version released after 20070710 to resolve the issue.

Fix

Related Identifiers

CVE-2007-3717

Affected Products

Sun Solaris

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-3717 · Security Note
• http://secunia.com/advisories/26024 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1772 · Note
• http://osvdb.org/36611 · Note
• http://vupen.com/english/advisories/2007/2494 · Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102978-1 · Patch, Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2007-319.htm · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35334 · Note
• http://secunia.com/advisories/26210 · Note