PT-2017-2672 · Oracle · Solaris

Published 2017-07-18 · Updated 2019-10-03 · CVE-2017-10036

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Sun Systems Products Suite (Solaris component) versions 10 and 11

Description The issue is related to a vulnerability in the NFSv4 protocol of the Solaris operating system, which is associated with inadequate access control. This vulnerability can be easily exploited by an unauthenticated attacker with network access via NFSv4, allowing them to compromise Solaris. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of Solaris.

Recommendations For versions 10 and 11, consider restricting access to the NFSv4 protocol to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the NFSv4 service until a fix is provided.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-01900

CVE-2017-10036

Affected Products

Solaris

References · 6

• https://osv.dev/vulnerability/CVE-2017-10036 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01900 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10036 · Security Note
• http://securityfocus.com/bid/99840 · Note
• http://securitytracker.com/id/1038938 · Note