PT-2023-2541 · Oracle · Oracle Solaris

Published 2023-04-18 · Updated 2024-09-17 · CVE-2023-21896

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Solaris versions 10 and 11

Description The issue is related to errors in handling input data in the NSSwitch component of Oracle Solaris, which can be exploited to compromise the system. A successful attack can result in the takeover of Oracle Solaris. The exploitation of this issue is considered difficult and requires a low-privileged attacker with logon access to the infrastructure where Oracle Solaris is executed.

Recommendations For Oracle Solaris version 10, update to a version that includes the fix for this issue. For Oracle Solaris version 11, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the NSSwitch component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-269

Related Identifiers

BDU:2023-02344

CVE-2023-21896

Affected Products

Oracle Solaris

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-21896 · Security Note
• https://bdu.fstec.ru/vul/2023-02344 · Security Note
• https://oracle.com/security-alerts/cpuapr2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21896 · Vendor Advisory