PT-2009-4587 · Sun · Opensolaris+1

Published 2009-06-19 · Updated 2017-09-29 · CVE-2009-2135

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Sun Solaris versions 10 and earlier OpenSolaris versions prior to snv 107

Description The issue is related to multiple race conditions in the Solaris Event Port API. It allows local users to cause a denial of service, resulting in a system panic. The race condition occurs between the port dissociate and close functions.

Recommendations For Sun Solaris version 10 and earlier, update to a version later than the affected one. For OpenSolaris versions prior to snv 107, update to a version later than snv 107. As a temporary workaround, consider restricting access to the Solaris Event Port API to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2009-2135

Affected Products

Opensolaris

Sun Solaris

References · 12

• http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-01-1 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-260449-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2135 · Security Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-246.htm · Note
• http://securityfocus.com/bid/35437 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5906 · Note
• http://secunia.com/advisories/35279 · Note
• http://securitytracker.com/id?1022422 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51284 · Note
• http://osvdb.org/55231 · Note
• http://osvdb.org/55232 · Note
• http://vupen.com/english/advisories/2009/1634 · Note