Sun Solaris vulnerabilities

CVE-2002-0089 [HIGH] CVE-2002-0089: Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via Buffer overflow in admintool in Solaris 2.5 through 8 allows local users to gain root privileges via long arguments to (1) the -d command line option, or (2) the PRODVERS argument in the .cdtoc file.

CVE-1999-0135 [HIGH] CVE-1999-0135: admintool in Solaris allows a local user to write to arbitrary files and gain root access. admintool in Solaris allows a local user to write to arbitrary files and gain root access.

CVE-1999-0339 [HIGH] CVE-1999-0339: Buffer overflow in the libauth library in Solaris allows local users to gain additional privileges, Buffer overflow in the libauth library in Solaris allows local users to gain additional privileges, possibly root access.

CVE-2003-1068 [HIGH] CVE-2003-1068: Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges, Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges, as identified by Sun BugID 4659277, a different vulnerability than CVE-2003-1082.

CVE-2008-3875 [HIGH] CWE-264 CVE-2008-3875: The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass ch The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls.

CVE-2007-2529 [HIGH] CVE-2007-2529: Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local us Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local users to cause a denial of service (kernel panic) and possibly gain privileges via a certain argument, related to ACE_SETACL.

CVE-2002-1590 [HIGH] CWE-264 CVE-2002-1590: The Web-Based Enterprise Management (WBEM) packages (1) SUNWwbdoc, (2) SUNWwbcou, (3) SUNWwbdev and The Web-Based Enterprise Management (WBEM) packages (1) SUNWwbdoc, (2) SUNWwbcou, (3) SUNWwbdev and (4) SUNWmgapp packages, when installed using Solaris 8 Update 1/01 or later, install files with world or group write permissions, which allows local users to gain root privileges or cause a denial of service.

CVE-1999-0952 [HIGH] CVE-1999-0952: Buffer overflow in Solaris lpstat via class argument allows local users to gain root access. Buffer overflow in Solaris lpstat via class argument allows local users to gain root access.

CVE-2006-6494 [MEDIUM] CVE-2006-6494: Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execu Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.

CVE-2007-2882 [MEDIUM] CVE-2007-2882: Unspecified vulnerability in the NFS client module in Sun Solaris 8 through 10 before 20070524, when Unspecified vulnerability in the NFS client module in Sun Solaris 8 through 10 before 20070524, when operating as an NFS server, allows remote attackers to cause a denial of service (crash) via certain Access Control List (acl) packets.

CVE-1999-0189 [HIGH] CVE-1999-0189: Solaris rpcbind listens on a high numbered UDP port, which may not be filtered since the standard po Solaris rpcbind listens on a high numbered UDP port, which may not be filtered since the standard port number is 111.

CVE-2002-1296 [HIGH] CVE-2002-1296: Directory traversal vulnerability in priocntl system call in Solaris does allows local users to exec Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module.

CVE-2002-0088 [HIGH] CVE-2002-0088: Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via Buffer overflow in admintool in Solaris 2.6, 7, and 8 allows local users to gain root privileges via a long media installation path.

CVE-2006-0190 [HIGH] CVE-2006-0190: Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain pr Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver.

CVE-2006-0769 [HIGH] CVE-2006-0769: Unspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerber Unspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerberos systems via unknown attack vectors.

CVE-1999-1027 [HIGH] CVE-1999-1027: Solaris 2.6 HW3/98 installs admintool with world-writable permissions, which allows local users to g Solaris 2.6 HW3/98 installs admintool with world-writable permissions, which allows local users to gain privileges by replacing it with a Trojan horse program.

CVE-2000-0055 [HIGH] CVE-2000-0055: Buffer overflow in Solaris chkperm command allows local users to gain root access via a long -n opti Buffer overflow in Solaris chkperm command allows local users to gain root access via a long -n option.

CVE-2009-0875 [MEDIUM] CWE-362 CVE-2009-0875: Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris bef Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allows local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors involving the time at which control is transferred from a caller to a door server.

CVE-2008-6024 [MEDIUM] CWE-399 CVE-2008-6024: Unspecified vulnerability in the NFSv4 client module in the kernel on Sun Solaris 10 and OpenSolaris Unspecified vulnerability in the NFSv4 client module in the kernel on Sun Solaris 10 and OpenSolaris before snv_37, when automountd is used, allows user-assisted remote attackers to cause a denial of service (unresponsive NFS filesystems) via unknown vectors.

CVE-2003-1066 [MEDIUM] CVE-2003-1066: Buffer overflow in the syslog daemon for Solaris 2.6 through 9 allows remote attackers to cause a de Buffer overflow in the syslog daemon for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (syslogd crash) and possibly execute arbitrary code via long syslog UDP packets.