PT-2015-4241 · Oracle · Illumos

Robert Mustacchio · Published 2015-01-20 · Updated 2017-09-08 · CVE-2014-9491

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions illumos (affected versions not specified)

Description The issue is related to the devzvol readdir function in illumos, which fails to check the return value of a strchr call. This oversight allows remote attackers to trigger a denial of service, resulting in a NULL pointer dereference and panic, via unspecified vectors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2014-9491

Affected Products

Illumos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-9491 · Security Note
• https://github.com/illumos/illumos-gate/commit/d65686849024838243515b5c40ae2c479460b4b5 · Note
• http://seclists.org/oss-sec/2015/q1/27 · Note
• https://illumos.org/issues/5421 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99686 · Note