PT-2020-3877 · Oracle · Oracle Solaris

Published 2020-07-15 · Updated 2020-07-20 · CVE-2020-14545

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Oracle Solaris version 11

Description: The issue is related to inadequate access control in the Device Driver Utility component. It allows a low-privileged attacker with logon access to the infrastructure where Oracle Solaris is executed to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized access to modify, delete, or create critical data, as well as cause a partial denial of service (DOS) of Oracle Solaris.

Recommendations: For Oracle Solaris version 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-04269

CVE-2020-14545

Affected Products

Oracle Solaris

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-14545 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14545 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04269 · Security Note