PT-2008-6741 · Oracle · Opensolaris+1

Tobias Klein · Published 2008-12-19 · Updated 2018-10-11 · CVE-2008-5689

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Solaris versions 10 and OpenSolaris snv 01 through snv 76

Description The issue allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request. This request triggers a NULL pointer dereference in the tun in IP Tunnel component.

Recommendations For Solaris versions 10 and OpenSolaris snv 01 through snv 76, consider restricting access to the tun in IP Tunnel component to minimize the risk of exploitation. As a temporary workaround, avoid using the SIOCGTUNPARAM IOCTL request until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-5689

Affected Products

Opensolaris

Solaris

References · 13

• 🔥 https://exploit-db.com/exploits/15962 · Exploit
• 🔥 http://exploit-db.com/exploits/15962 · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-242266-1 · Vendor Advisory
• http://secunia.com/advisories/33160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5689 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5949 · Note
• http://vupen.com/english/advisories/2008/3454 · Note
• http://trapkit.de/advisories/TKADV2008-015.txt · Note
• http://securityfocus.com/bid/32904 · Note
• http://securityreason.com/securityalert/4801 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47449 · Note
• http://securitytracker.com/id?1021464 · Note
• http://securityfocus.com/archive/1/499352/100/0/threaded · Note