PT-2020-4757 · Oracle · Oracle Solaris

Larry W. Cashdollar · Published 2020-10-20 · Updated 2020-10-22 · CVE-2020-14758

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Oracle Solaris version 11

Description: The issue is related to insufficient access control in the Kernel component of Oracle Solaris, which can be exploited to gain unauthorized access to sensitive information or cause a denial of service. The vulnerability can be easily exploited by a low-privileged attacker with logon access to the infrastructure where Oracle Solaris is executed, but it requires human interaction from a person other than the attacker. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data, as well as the ability to cause a partial denial of service.

Recommendations: For Oracle Solaris version 11, apply the necessary patches or updates to fix the vulnerability in the Kernel component. As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-05309

CVE-2020-14758

Affected Products

Oracle Solaris

References · 4

• https://osv.dev/vulnerability/CVE-2020-14758 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-14758 · Security Note