PT-2008-4155 · Sun · Opensolaris+1

Tobias Klein · Published 2008-06-16 · Updated 2018-10-30 · CVE-2008-2710

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Solaris 10 and OpenSolaris before snv 92

Description The issue is caused by an integer signedness error in the ip set srcfilter function in the IP Multicast Filter. This error allows local users to execute arbitrary code in other Solaris Zones via an SIOCSIPMSFILTER IOCTL request with a large value of the imsf numsrc field. The error triggers an out-of-bounds write of kernel memory.

Recommendations For Sun Solaris 10 and OpenSolaris before snv 92, consider restricting access to the SIOCSIPMSFILTER IOCTL request to minimize the risk of exploitation. As a temporary workaround, limit the value of the imsf numsrc field to prevent out-of-bounds writes. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-2710

Affected Products

Opensolaris

Sun Solaris 10

References · 9

• 🔥 http://trapkit.de/advisories/TKADV2008-003.txt · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-237965-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2710 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5731 · Note
• http://secunia.com/advisories/30693 · Note
• http://securityfocus.com/bid/29699 · Note
• http://vupen.com/english/advisories/2008/1832/references · Note
• http://securitytracker.com/id?1020283 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43068 · Note