PT-2019-3578 · Oracle · Oracle Solaris+1

Marco Ivaldi · Published 2019-10-15 · Updated 2025-04-15 · CVE-2019-3010

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11

Description The issue is related to a component called XScreenSaver in the Oracle Solaris operating system, which has inadequate access control. This can be exploited by an attacker to gain full control over the system. The vulnerability is easily exploitable and can be used by a low-privileged attacker with logon access to the infrastructure where Oracle Solaris is executed. Successful attacks can result in the takeover of Oracle Solaris and may also impact additional products.

Recommendations For Oracle Solaris version 11, apply the official fix to resolve the issue. As a temporary workaround, consider disabling the XScreenSaver component until a patch is available. Restrict access to the XScreenSaver component to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-03783

CVE-2019-3010

Affected Products

Oracle Solaris

Xscreensaver

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/local/xscreensaver_log_priv_esc.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/154960/Solaris-xscreensaver-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/47529 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3010 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03783 · Security Note
• https://github.com/microsoft/ebpf-for-windows · Note
• https://github.com/gwillgues/BPFDoor · Note
• https://t.me/cvenotify/96804 · Telegram Post
• https://t.me/rnetsec/10675 · Telegram Post
• https://t.me/defcon_news/27406 · Telegram Post
• https://t.me/aptreports/929 · Telegram Post
• https://t.me/secharvester/7731 · Telegram Post
• https://t.me/cybersecuritytechnologies/2629 · Telegram Post