PT-2009-3464 · Sun · Sun Solaris+1

Published 2009-03-11 · Updated 2017-08-17 · CVE-2009-0872

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Solaris versions 10 OpenSolaris versions prior to snv 111

Description The issue concerns the NFS server's improper implementation of the AUTH NONE security mode when combined with other security modes. This allows remote attackers to bypass access restrictions, enabling them to read or modify files. An example of this vulnerability is when AUTH NONE is used in combination with AUTH SYS.

Recommendations For Sun Solaris 10, consider restricting access to the NFS server until a proper fix is applied. For OpenSolaris versions prior to snv 111, update to a version after snv 111 to resolve the issue. As a temporary workaround, consider disabling the use of the AUTH NONE security mode in combination with other modes until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0872

Affected Products

Opensolaris

Sun Solaris

References · 12

• 🔥 http://securityfocus.com/bid/34063 · Exploit
• http://secunia.com/advisories/34213 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-0872 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253588-1 · Vendor Advisory
• http://vupen.com/english/advisories/2009/0658 · Vendor Advisory
• http://securitytracker.com/id?1021833 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49170 · Note
• http://secunia.com/advisories/34429 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-093.htm · Note
• http://osvdb.org/52559 · Note
• http://vupen.com/english/advisories/2009/0798 · Note