PT-2020-2638 · Oracle · Oracle Solaris

Published 2020-04-15 · Updated 2020-04-15 · CVE-2020-2749

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11

Description The issue is related to insufficient input validation in the svcbundle component of Oracle Solaris. This can allow a remote attacker to gain unauthorized access to protected information. The vulnerability is difficult to exploit and requires human interaction from someone other than the attacker. Successful attacks can result in unauthorized access to update, insert, or delete some of the data accessible by Oracle Solaris.

Recommendations For Oracle Solaris version 11, consider restricting access to the svcbundle component until a patch is available. As a temporary workaround, limit the use of the SMF command svcbundle to minimize the risk of exploitation. Ensure that only authorized personnel have logon access to the infrastructure where Oracle Solaris executes.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-02676

CVE-2020-2749

Affected Products

Oracle Solaris

References · 5

• https://osv.dev/vulnerability/CVE-2020-2749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2749 · Security Note
• https://bdu.fstec.ru/vul/2020-02676 · Security Note
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2020042371 · Note