PT-2009-4638 · Sun · Sun Solaris 10+1

Published 2009-06-24 · Updated 2009-06-25 · CVE-2009-2187

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Sun Solaris 10 OpenSolaris versions snv 67 through snv 93

Description The issue is related to multiple memory leaks in the IP and IPv6 multicast implementation in the kernel. Local users can cause a denial of service due to memory consumption by exploiting the association of certain messages with ARP messages, specifically DL ENABMULTI REQ and DL DISABMULTI REQ messages.

Recommendations For Sun Solaris 10, apply the recommended patch to fix the memory leaks. For OpenSolaris versions snv 67 through snv 93, upgrade to a version later than snv 93 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability for other versions.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-2187

Affected Products

Opensolaris

Sun Solaris 10

References · 7

• 🔥 http://bugs.opensolaris.org/view_bug.do?bug_id=6731600 · Exploit
• http://securityfocus.com/bid/35474 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-01-1 · Patch
• http://secunia.com/advisories/35552 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-262408-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2187 · Security Note
• http://bugs.opensolaris.org/view_bug.do?bug_id=6709252 · Note