PT-2016-3156 · Oracle · Solaris

Published 2016-12-06 · Updated 2019-10-03 · CVE-2017-3632

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Sun Systems Products Suite (Solaris) versions 10 and 11

Description The issue is related to inadequate access control in the CDE Calendar subcomponent of the Solaris operating system. It allows an unauthenticated attacker with network access via TCP to compromise Solaris, potentially resulting in a takeover of the system.

Recommendations For versions 10 and 11, update to a version that includes the necessary security patches to address the inadequate access control in the CDE Calendar subcomponent. As a temporary workaround, consider restricting network access to the Solaris system via TCP to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-01957

CVE-2017-3632

Affected Products

Solaris

References · 6

• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3632 · Security Note
• https://bdu.fstec.ru/vul/2017-01957 · Security Note
• http://securitytracker.com/id/1038938 · Note
• http://securityfocus.com/bid/99857 · Note