Sun Solaris vulnerabilities

CVE-1999-0676 [MEDIUM] CVE-1999-0676: sdtcm_convert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack. sdtcm_convert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.

CVE-2006-3825 [LOW] CVE-2006-3825: The IPv4 implementation in Sun Solaris 10 before 20060721 allows local users to select routes that d The IPv4 implementation in Sun Solaris 10 before 20060721 allows local users to select routes that differ from the routing table, possibly facilitating firewall bypass or unauthorized network communication.

CVE-2005-3071 [LOW] CVE-2005-3071: Unspecified vulnerability in Unix File System (UFS) on Solaris 8 and 9, when logging is enabled, all Unspecified vulnerability in Unix File System (UFS) on Solaris 8 and 9, when logging is enabled, allows local users to cause a denial of service ("soft hang") via certain write operations to UFS.

CVE-2005-2032 [LOW] CVE-2005-2032: Unknown vulnerability in lpadmin on Sun Solaris 7, 8, and 9 allows local users to overwrite arbitrar Unknown vulnerability in lpadmin on Sun Solaris 7, 8, and 9 allows local users to overwrite arbitrary files.

CVE-2005-3001 [LOW] CVE-2005-3001: Unspecified vulnerability in the "tl" driver in Solaris 10 allows local users to cause a denial of s Unspecified vulnerability in the "tl" driver in Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.

CVE-2006-1092 [LOW] CVE-2006-1092: Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed.

CVE-2006-0516 [LOW] CVE-2006-0516: Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64 Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors.

CVE-2005-4133 [LOW] CVE-2005-4133: Sun Update Connection in Sun Solaris 10, when configured to use a web proxy, allows local users to o Sun Update Connection in Sun Solaris 10, when configured to use a web proxy, allows local users to obtain the proxy authentication password via (1) an unspecified vector and (2) proxy log files.

CVE-2005-1518 [LOW] CVE-2005-1518: Unknown vulnerability in Solaris 7 through 9, when using Federated Naming Services (FNS), autofs, an Unknown vulnerability in Solaris 7 through 9, when using Federated Naming Services (FNS), autofs, and FNS X.500 configuration, allows local users to cause a denial of service (automountd crash) when "accessing" /xfn/_x500.

CVE-2003-1061 [LOW] CVE-2003-1061: Race condition in Solaris 2.6 through 9 allows local users to cause a denial of service (kernel pani Race condition in Solaris 2.6 through 9 allows local users to cause a denial of service (kernel panic), as demonstrated via the namefs function, pipe, and certain STREAMS routines.

CVE-2008-5690 [LOW] CWE-255 CVE-2008-5690: The Kerberos credential renewal feature in Sun Solaris 8, 9, and 10, and OpenSolaris build snv_01 th The Kerberos credential renewal feature in Sun Solaris 8, 9, and 10, and OpenSolaris build snv_01 through snv_104, allows local users to cause a denial of service (authentication failure) via unspecified vectors related to incorrect cache file permissions, and lack of credential storage by the store_cred function in pam_krb5.

CVE-2006-1780 [LOW] CVE-2006-1780: The Bourne shell (sh) in Solaris 8, 9, and 10 allows local users to cause a denial of service (sh cr The Bourne shell (sh) in Solaris 8, 9, and 10 allows local users to cause a denial of service (sh crash) via an unspecified attack vector that causes sh processes to crash during creation of temporary files.

CVE-2002-1586 [LOW] CVE-2002-1586: Solaris 2.5.1 through 9 allows local users to cause a denial of service (kernel panic) by setting th Solaris 2.5.1 through 9 allows local users to cause a denial of service (kernel panic) by setting the sd_struiowrq variable in the struioget function to null, which triggers a null dereference.

CVE-2002-1587 [LOW] CVE-2002-1587: The libthread library (libthread.so.1) for Solaris 2.5.1 through 8 allows local users to cause a den The libthread library (libthread.so.1) for Solaris 2.5.1 through 8 allows local users to cause a denial of service (hang) of an application that uses libthread by causing the application to wait for a certain mutex.

CVE-2002-1589 [LOW] CVE-2002-1589: Unknown vulnerability in Solaris 8, when the 0x02 bit (aka TEST, KMF_DEADBEEF, or deadbeef) is set i Unknown vulnerability in Solaris 8, when the 0x02 bit (aka TEST, KMF_DEADBEEF, or deadbeef) is set in the kmem_flags kernel parameter, allows local users to cause a denial of service (system panic).

CVE-1999-1118 [LOW] CVE-1999-1118: ndd in Solaris 2.6 allows local users to cause a denial of service by modifying certain TCP/IP param ndd in Solaris 2.6 allows local users to cause a denial of service by modifying certain TCP/IP parameters.

CVE-2007-4126 [LOW] CVE-2007-4126: Unspecified vulnerability in the dynamic tracing framework (DTrace) on Sun Solaris 10 before 2007073 Unspecified vulnerability in the dynamic tracing framework (DTrace) on Sun Solaris 10 before 20070730 allows local users with PRIV_DTRACE_USER privileges to cause a denial of service (panic or hang) via unspecified use of certain DTrace programs.

CVE-2006-5214 [LOW] CVE-2006-5214: Race condition in the Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, Race condition in the Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060225, and Solaris 8 through 10 before 20061006, causes a user's Xsession errors file to have weak permissions before a chmod is performed, which allows local users to read Xsession errors files of other users.

CVE-2003-0669 [LOW] CVE-2003-0669: Unknown vulnerability in Solaris 2.6 through 9 causes a denial of service (system panic) via "a rare Unknown vulnerability in Solaris 2.6 through 9 causes a denial of service (system panic) via "a rare race condition" or an attack by local users.

CVE-2009-1276 [LOW] CWE-200 CVE-2009-1276: XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109, and Solaris 8 and 9 with GNOME 2.0 or XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail notifications.