PT-2020-1416 · Oracle · X-Window-System+1

Marco Ivaldi · Published 2020-01-14 · Updated 2022-10-25 · CVE-2020-2656

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Solaris versions 10 and 11

Description The issue is related to inadequate access control in the X Window System component of Oracle Solaris. It allows an attacker with low privileges and logon access to the infrastructure to compromise Oracle Solaris, potentially leading to unauthorized access, modification, or deletion of data, as well as unauthorized read access to protected information.

Recommendations For versions 10 and 11, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the X Window System component to minimize the risk of unauthorized data access or modification.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00389

CVE-2020-2656

Affected Products

Oracle Solaris

X-Window-System

References · 11

• 🔥 http://seclists.org/fulldisclosure/2020/Jan/23 · Exploit
• 🔥 http://packetstormsecurity.com/files/155990/Solaris-xlock-Information-Disclosure.html · Exploit
• 🔥 https://seclists.org/bugtraq/2020/Jan/23 · Exploit
• https://osv.dev/vulnerability/CVE-2020-2656 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00389 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2656 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2629 · Telegram Post
• http://openwall.com/lists/oss-security/2020/01/20/2 · Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note
• https://t.me/defcon_news/35894 · Telegram Post