PT-2020-4751 · Oracle · Oracle Solaris

Aaron Carreras + 2 · Published 2020-10-20 · Updated 2025-02-07 · CVE-2020-14871

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Oracle Solaris versions 10 and 11

Description: The issue is related to a buffer overflow vulnerability in the Pluggable authentication module of Oracle Solaris, which can be exploited by an unauthenticated attacker with network access via multiple protocols to compromise the system. This vulnerability may significantly impact additional products and can result in the takeover of Oracle Solaris. There have been reports of real-world attacks exploiting this issue, with an exploit being sold on the black market. The vulnerability is easily exploitable and can allow remote takeover of the system.

Recommendations: For Oracle Solaris versions 10 and 11, update to a version that is not affected by this vulnerability, as the exact fixed version is not specified. As a temporary workaround, consider disabling the parse user name() function of the Pluggable authentication module until a patch is available. Restrict access to the Pluggable authentication module to minimize the risk of exploitation. Avoid using the Pluggable authentication module for SSHD or other network services until the issue is resolved.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2020-05303

CVE-2020-14871

Affected Products

Oracle Solaris

References · 28

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/ssh/pam_username_bof.rb · Exploit
• 🔥 https://exploit-db.com/exploits/49896 · Exploit
• 🔥 http://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html · Exploit
• 🔥 http://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.html · Exploit
• 🔥 https://exploit-db.com/exploits/50039 · Exploit
• 🔥 http://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.html · Exploit
• 🔥 https://exploit-db.com/exploits/49261 · Exploit
• http://openwall.com/lists/oss-security/2024/07/03/3 · Patch
• https://oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14871 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14871 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05303 · Security Note
• https://t.me/true_secator/1120 · Telegram Post
• http://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html · Note
• https://t.me/tmfeed/96345 · Telegram Post