PT-2009-3434 · Sun · Sun Solaris+1

Published 2009-03-06 · Updated 2018-10-30 · CVE-2009-0838

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Sun Solaris versions 10 OpenSolaris versions snv 88 through snv 102

Description The issue is related to the crypto pseudo device driver, which does not properly free memory. This can be exploited by local users to cause a denial of service, resulting in a system panic. The problem is associated with the vmem hash delete function.

Recommendations For Sun Solaris version 10, update to a version that properly frees memory in the crypto pseudo device driver. For OpenSolaris versions snv 88 through snv 102, update to a version that properly frees memory in the crypto pseudo device driver. As a temporary workaround, consider restricting access to the crypto pseudo device driver to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0838

Affected Products

Opensolaris

Sun Solaris

References · 12

• http://secunia.com/advisories/34149 · Vendor Advisory
• http://vupen.com/english/advisories/2009/0606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0838 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-254088-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139498-04-1 · Vendor Advisory
• http://vupen.com/english/advisories/2009/0815 · Note
• http://securitytracker.com/id?1021810 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-097.htm · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49105 · Note
• http://secunia.com/advisories/34455 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5641 · Note
• http://securityfocus.com/bid/34000 · Note