Sun Solaris vulnerabilities

CVE-2007-6180 [HIGH] CWE-362 CVE-2007-6180: Race condition in the Remote Procedure Call kernel module (rpcmod) in Sun Solaris 8 through 10 allow Race condition in the Remote Procedure Call kernel module (rpcmod) in Sun Solaris 8 through 10 allows local users to cause a denial of service (NULL dereference and panic) via unspecified vectors.

CVE-2008-1095 [MEDIUM] CWE-264 CVE-2008-1095: Unspecified vulnerability in the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10 a Unspecified vulnerability in the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service (panic) via unknown vectors, possibly related to ICMP packets and IP fragment reassembly.

CVE-2006-4319 [HIGH] CVE-2006-4319: Buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to form Buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to format (such as the "File System Management" RBAC profile) to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2006-4307.

CVE-2005-0816 [HIGH] CVE-2005-0816: Buffer overflow in newgrp in Solaris 7 through 9 allows local users to gain root privileges. Buffer overflow in newgrp in Solaris 7 through 9 allows local users to gain root privileges.

CVE-2003-0091 [HIGH] CVE-2003-0091: Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local us Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege.

CVE-1999-0190 [HIGH] CVE-1999-0190: Solaris rpcbind can be exploited to overwrite arbitrary files and gain root access. Solaris rpcbind can be exploited to overwrite arbitrary files and gain root access.

CVE-2008-3838 [HIGH] CWE-20 CVE-2008-3838: Unspecified vulnerability in the NFS Remote Procedure Calls (RPC) zones implementation in Sun Solari Unspecified vulnerability in the NFS Remote Procedure Calls (RPC) zones implementation in Sun Solaris 10 and OpenSolaris before snv_88 allows local administrators of non-global zones to read and modify NFS traffic for arbitrary non-global zones, possibly leading to file modifications or a denial of service.

CVE-1999-0837 [CRITICAL] CVE-1999-0837: Denial of service in BIND by improperly closing TCP sessions via so_linger. Denial of service in BIND by improperly closing TCP sessions via so_linger.

CVE-2006-7140 [MEDIUM] CVE-2006-7140: The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents libike from correctly verifying X.509 and other certificates that use PKCS #1, a s

CVE-1999-0213 [CRITICAL] CVE-1999-0213: libnsl in Solaris allowed an attacker to perform a denial of service of rpcbind. libnsl in Solaris allowed an attacker to perform a denial of service of rpcbind.

CVE-1999-0022 [HIGH] CWE-125 CVE-1999-0022: Local user gains root privileges via buffer overflow in rdist, via expstr() function. Local user gains root privileges via buffer overflow in rdist, via expstr() function.

CVE-2009-2297 [HIGH] CVE-2009-2297: Unspecified vulnerability in the udp subsystem in the kernel in Sun Solaris 10, and OpenSolaris snv_ Unspecified vulnerability in the udp subsystem in the kernel in Sun Solaris 10, and OpenSolaris snv_90 through snv_108, when Solaris Trusted Extensions is enabled, allows remote attackers to cause a denial of service (panic) via unspecified vectors involving the crgetlabel function, related to a "TX panic." NOTE: this issue exists because of a regression in ear

CVE-2008-1779 [MEDIUM] CWE-399 CVE-2008-1779: Sun Solaris 8, 9, and 10 allows "remote privileged" users to cause a denial of service (panic) via u Sun Solaris 8, 9, and 10 allows "remote privileged" users to cause a denial of service (panic) via unknown vectors related to self encapsulated IP packets.

CVE-2009-2652 [MEDIUM] CVE-2009-2652: Unspecified vulnerability in Solaris Trusted Extensions in Sun Solaris 10, and OpenSolaris snv_37 th Unspecified vulnerability in Solaris Trusted Extensions in Sun Solaris 10, and OpenSolaris snv_37 through snv_120, allows remote attackers to cause a denial of service (panic) via vectors involving the parsing of labeled packets.

CVE-2004-0496 [HIGH] CVE-2004-0496: Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel memory, a different set of vulnerabilities than those identified in CVE-2004-0495, as found by the Sparse source code checking tool.

CVE-2008-0242 [HIGH] CVE-2008-0242: Unspecified vulnerability in libdevinfo in Sun Solaris 10 allows local users to access files and gai Unspecified vulnerability in libdevinfo in Sun Solaris 10 allows local users to access files and gain privileges via unknown vectors, related to login device permissions.

CVE-2009-4075 [MEDIUM] CVE-2009-4075: Unspecified vulnerability in the timeout mechanism in sshd in Sun Solaris 10, and OpenSolaris snv_99 Unspecified vulnerability in the timeout mechanism in sshd in Sun Solaris 10, and OpenSolaris snv_99 through snv_123, allows remote attackers to cause a denial of service (daemon outage) via unknown vectors that trigger a "dangling sshd authentication thread."

CVE-2007-0914 [HIGH] CVE-2007-0914: Race condition in the TCP subsystem for Solaris 10 allows remote attackers to cause a denial of serv Race condition in the TCP subsystem for Solaris 10 allows remote attackers to cause a denial of service (system panic) via unknown vectors.

CVE-2008-3666 [HIGH] CVE-2008-3666: Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-depende Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-dependent attackers to cause a denial of service (panic) via vectors involving creation of a crafted file and use of the sendfilev system call, as demonstrated by a file served by an Apache 2.2.x web server with EnableSendFile configured; and (2) local users to cause a

CVE-2007-5726 [MEDIUM] CVE-2007-5726: Unspecified vulnerability in the Stream Control Transmission Protocol (sctp) functionality in Sun So Unspecified vulnerability in the Stream Control Transmission Protocol (sctp) functionality in Sun Solaris 10, when at least one SCTP socket is in the LISTEN state, allows remote attackers to cause a denial of service (panic) via unspecified vectors related to "INIT processing."