PT-2017-2671 · Oracle · Solaris

Published 2017-07-18 · Updated 2019-10-03 · CVE-2017-10042

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Sun Systems Products Suite (Solaris component) versions 10 and 11

Description The issue is related to a vulnerability in the IKE protocol of the Solaris operating system, which is associated with inadequate access control. This vulnerability can be easily exploited by an unauthenticated attacker with network access via IKE, allowing them to compromise Solaris. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of Solaris.

Recommendations For versions 10 and 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the IKE protocol to minimize the risk of exploitation.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-01899

CVE-2017-10042

Affected Products

Solaris

References · 6

• https://bdu.fstec.ru/vul/2017-01899 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10042 · Security Note
• http://securityfocus.com/bid/99838 · Note
• http://securitytracker.com/id/1038938 · Note