PT-2009-6421 · Oracle · Sun Ray 1+3

Published 2009-12-11 · Updated 2009-12-14 · CVE-2009-4295

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Ray Server Software versions 4.0 through 4.1

Description The issue allows remote attackers to obtain sensitive information by predicting a key and then using it to decrypt sniffed network traffic, due to the lack of unique DSA private key generation for the firmware on each Sun Ray device.

Recommendations For Sun Ray Server Software versions 4.0 through 4.1, consider regenerating a unique DSA private key for the firmware on each Sun Ray 1, 1g, 100, and 150 DTU device to prevent remote attackers from predicting a key and decrypting network traffic.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-4295

Affected Products

Sun Ray 1

Sun Ray 100

Sun Ray 150

Sun Ray Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-4295 · Security Note
• http://vupen.com/english/advisories/2009/3477 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270549-1 · Vendor Advisory
• http://securityfocus.com/bid/37285 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-07-1 · Patch