PT-2023-2660 · Oracle · Oracle Solaris

Published 2023-04-18 · Updated 2023-04-19 · CVE-2023-21948

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 10

Description The issue is related to errors in processing input data in the Core component of the Oracle Solaris operating system. Exploitation of this issue can allow an attacker to execute arbitrary code, potentially leading to the takeover of Oracle Solaris. The vulnerability is easily exploitable and can be compromised by a low-privileged attacker with logon access to the infrastructure where Oracle Solaris is executed.

Recommendations For Oracle Solaris version 10, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-02500

CVE-2023-21948

Affected Products

Oracle Solaris

References · 5

• https://osv.dev/vulnerability/CVE-2023-21948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21948 · Security Note
• https://bdu.fstec.ru/vul/2023-02500 · Security Note
• https://oracle.com/security-alerts/cpuapr2023.html · Vendor Advisory
• https://t.me/cibsecurity/62409 · Telegram Post