PT-2024-1189 · Oracle · Oracle Solaris

Published 2024-01-16 · Updated 2024-11-27 · CVE-2024-20920

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11

Description The issue is related to insufficient input validation in the Filesystem component of Oracle Solaris. This easily exploitable vulnerability allows a low-privileged attacker with logon access to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris, potentially resulting in unauthorized read access to a subset of Oracle Solaris accessible data. Successful attacks may significantly impact additional products.

Recommendations For Oracle Solaris version 11, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and strengthen input validation for the Filesystem component to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

RCE

Weakness Enumeration

CWE-200

CWE-20

Related Identifiers

BDU:2024-00516

CVE-2024-20920

Affected Products

Oracle Solaris

References · 7

• https://oracle.com/security-alerts/cpujan2024.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20920 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20920 · Vendor Advisory
• https://twitter.com/CVEnew/status/1747458203204432344 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024011724 · Note
• https://twitter.com/VulmonFeeds/status/1747407024227246497 · Twitter Post