Sun Solaris vulnerabilities

CVE-1999-1025 [MEDIUM] CVE-1999-1025: CDE screen lock program (screenlock) on Solaris 2.6 does not properly lock an unprivileged user's co CDE screen lock program (screenlock) on Solaris 2.6 does not properly lock an unprivileged user's console session when the host is an NIS+ client, which allows others with physical access to login with any string.

CVE-2004-0653 [LOW] CVE-2004-0653: Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files.

CVE-2009-4774 [MEDIUM] CVE-2009-4774: Unspecified vulnerability in Sun Solaris 10 and OpenSolaris snv_49 through snv_117, when 64bit mode Unspecified vulnerability in Sun Solaris 10 and OpenSolaris snv_49 through snv_117, when 64bit mode is used on the Intel x86 platform and a Linux (lx) branded zone is configured, allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2007-6225.

CVE-2007-6505 [LOW] CWE-16 CVE-2007-6505: Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even when the user logging into ssh is not root, which makes it easier for attackers to avoid detection and can make it more difficult to conduct forensics activities.

CVE-2005-0576 [LOW] CVE-2005-0576: Unknown vulnerability in Standard Type Services Framework (STSF) Font Server Daemon (stfontserverd) Unknown vulnerability in Standard Type Services Framework (STSF) Font Server Daemon (stfontserverd) in Solaris 9 allows local users to modify or delete arbitrary files.

CVE-2006-0227 [LOW] CVE-2006-0227: Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to del Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors.

CVE-2002-2203 [MEDIUM] CVE-2002-2203: Unknown vulnerability in the System Serial Console terminal in Solaris 2.5.1, 2.6, and 7 allows loca Unknown vulnerability in the System Serial Console terminal in Solaris 2.5.1, 2.6, and 7 allows local users to monitor keystrokes and possibly steal sensitive information.

CVE-2008-0718 [MEDIUM] CWE-20 CVE-2008-0718: Unspecified vulnerability in the USB Mouse STREAMS module (usbms) in Sun Solaris 9 and 10, when 64-b Unspecified vulnerability in the USB Mouse STREAMS module (usbms) in Sun Solaris 9 and 10, when 64-bit mode is enabled, allows local users to cause a denial of service (panic) via unspecified vectors.

CVE-1999-0129 [MEDIUM] CVE-1999-0129: Sendmail allows local users to write to a file and gain group permissions via a .forward or :include Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

CVE-2007-5319 [LOW] CVE-2007-5319: Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local u Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access to cause a denial of service ("unusable" system console) via unspecified vectors.

CVE-2006-5215 [LOW] CVE-2006-5215: The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 2006 The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file.

CVE-2006-0161 [MEDIUM] CVE-2006-0161: Unspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors. NOT Unspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2004-0780.

CVE-1999-0303 [MEDIUM] CVE-1999-0303: Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames. Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

CVE-2006-1782 [LOW] CVE-2006-1782: Unspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server Unspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server root Distinguished Name (rootDN) password when a privileged user (1) runs idsconfig; or "insecurely" runs LDAP2 commands with the -w option, including (2) ldapadd, (3) ldapdelete, (4) ldapmodify, (5) ldapmodrdn, and (6) ldapsearch.

CVE-2004-1346 [LOW] CVE-2004-1346: The Sun Solaris Volume Manager (SVM) on Solaris 9 allows local users to cause a denial of service (k The Sun Solaris Volume Manager (SVM) on Solaris 9 allows local users to cause a denial of service (kernel panic) via a malformed probe request to the SVM.

CVE-2005-2032 [LOW] CVE-2005-2032: Unknown vulnerability in lpadmin on Sun Solaris 7, 8, and 9 allows local users to overwrite arbitrar Unknown vulnerability in lpadmin on Sun Solaris 7, 8, and 9 allows local users to overwrite arbitrary files.

CVE-2004-0654 [LOW] CVE-2004-0654: Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Admini Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic).

CVE-2003-1072 [LOW] CVE-2003-1072: Memory leak in lofiadm in Solaris 8 allows local users to cause a denial of service (kernel memory c Memory leak in lofiadm in Solaris 8 allows local users to cause a denial of service (kernel memory consumption).

CVE-2004-0481 [LOW] CVE-2004-0481: The logging feature in kcms_configure in the KCMS package on Solaris 8 and 9, and possibly other ver The logging feature in kcms_configure in the KCMS package on Solaris 8 and 9, and possibly other versions, allows local users to corrupt arbitrary files via a symlink attack on the KCS_ClogFile file.

CVE-2006-5213 [LOW] CVE-2006-5213: Sun Solaris 10 before 20061006 uses "incorrect and insufficient permission checks" that allow local Sun Solaris 10 before 20061006 uses "incorrect and insufficient permission checks" that allow local users to intercept or spoof packets by creating a raw socket on a link aggregation (network device aggregation).