PT-2009-6388 · Sun · Opensolaris

Published 2009-12-08 · Updated 2017-08-17 · CVE-2009-4226

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Sun OpenSolaris versions snv 106 through snv 124

Description A race condition in the IP module in the kernel allows remote attackers to cause a denial of service via unspecified vectors related to the (1) tcp do getsockname or (2) tcp do getpeername function, resulting in a NULL pointer dereference and panic.

Recommendations For Sun OpenSolaris versions snv 106 through snv 124, as a temporary workaround, consider restricting access to the IP module in the kernel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2009-4226

Affected Products

Opensolaris

References · 5

• 🔥 http://opensolaris.org/jive/thread.jspa?messageID=415069&tstart=0 · Exploit
• http://vupen.com/english/advisories/2009/3413 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-268189-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4226 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54574 · Note