PT-2022-3963 · Oracle · Oracle Solaris

Published 2022-07-19 · Updated 2022-07-23 · CVE-2022-21524

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11

Description The issue is related to insecure privilege management in the Filesystem component of Oracle Solaris. It allows a low-privileged attacker with network access via SMB to compromise Oracle Solaris. Successful attacks can result in the ability to cause a hang or crash of Oracle Solaris, as well as unauthorized access to update, insert, or delete some accessible data, and unauthorized read access to a subset of accessible data.

Recommendations For Oracle Solaris version 11, consider restricting access to the Filesystem component until a patch is available. As a temporary workaround, limit network access via SMB to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-04796

CVE-2022-21524

Affected Products

Oracle Solaris

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-21524 · Security Note
• https://bdu.fstec.ru/vul/2022-04796 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21524 · Vendor Advisory