CVSS: 7.9EPSS: 0%CPEs: 20EXPL: 3CVE-2012-0217 – FreeBSD - Intel SYSRET Privilege Escalation
https://notcve.org/view.php?id=CVE-2012-0217
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. El modo de usuario Scheduler en el núcleo en Microsoft Windows Server v2008 R2 y R2 SP1 y Windows v7 Gold y SP1 sobre la plataforma x64 no maneja adecuadamente solicitudes del sistema, lo que permite a usuarios locales obtener privilegios a través de una aplicación modificada, también conocida como "vulnerabilidad de corrupción de memoria de modo de usuario Scheduler". It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level. • https://www.exploit-db.com/exploits/46508 https://www.exploit-db.com/exploits/28718 https://www.exploit-db.com/exploits/20861 http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html http://lists.xen.org/archives/html/xen-devel/2012-06 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 2%CPEs: 3EXPL: 0CVE-2007-4310
https://notcve.org/view.php?id=CVE-2007-4310
The finger daemon (in.fingerd) in Sun Solaris 7 through 9 allows remote attackers to list all accounts that have certain nonstandard GECOS fields via a request composed of a single digit, as demonstrated by a "finger 9@host" command, a different vulnerability than CVE-2001-1503. El demonio finger (in.fingerd) en Sun Solaris 7 hasta 9 permite a atacantes remotos listar todas las cuentas que tienen campos GECOS que no son estándar mediante una petición compuesta de un único dígito, como ha sido demostrado por un comando "finger 9@host", una vulnerabilidad diferente de CVE-2001-1503. • http://securityreason.com/securityalert/2996 http://www.securityfocus.com/archive/1/474858/100/100/threaded http://www.securityfocus.com/archive/1/474927/100/100/threaded •
CVSS: 7.8EPSS: 33%CPEs: 3EXPL: 0CVE-2006-7028
https://notcve.org/view.php?id=CVE-2006-7028
Single CPU Sun systems running Solaris 7, 8, or 9, such as Netra, allows remote attackers to cause a denial of service (console hang) via a flood of small TCP/IP packets. NOTE: this issue has not been replicated by third parties. In addition, the cause is unknown, although it might be related to "jabber" and generation of a large amount of interrupts within the console, or a hardware error. Sistemas de una sola CPU Sun corriendo bajo Solaris 7, 8 o 9, como el Netra, permiten a atacantes remotos provocar una denegación de servicio (cuelgue de consola) mediante una inundación de pequeños paquetes TCP/IP. NOTA: esta vulnerabilidad no ha sido repetida por terceras partes. • http://www.securityfocus.com/archive/1/434449/30/4890/threaded http://www.securityfocus.com/archive/1/434920/30/4890/threaded http://www.securityfocus.com/archive/1/435107/30/4710/threaded http://www.securityfocus.com/archive/1/435146/30/4890/threaded •
CVSS: 5.0EPSS: 96%CPEs: 9EXPL: 2CVE-2005-4797 – Solaris LPD Arbitrary File Delete
https://notcve.org/view.php?id=CVE-2005-4797
Directory traversal vulnerability in printd line printer daemon (lpd) in Solaris 7 through 10 allows remote attackers to delete arbitrary files via ".." sequences in an "Unlink data file" command. • http://downloads.securityfocus.com/vulnerabilities/exploits/solaris_lpd_unlink.pm http://secunia.com/advisories/16367 http://securitytracker.com/id?1014635 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101842-1 http://www.ciac.org/ciac/bulletins/p-280.shtml http://www.osvdb.org/18650 http://www.securityfocus.com/bid/14510 http://www.vupen.com/english/advisories/2005/1342 https://exchange.xforce.ibmcloud.com/vulnerabilities/21773 •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2005-4795
https://notcve.org/view.php?id=CVE-2005-4795
Unspecified vulnerability in the multi-language environment library (libmle) in Solaris 7 and 8, as shipped with the Japanese locale, allows local users to gain privileges via unknown attack vectors. • http://secunia.com/advisories/16219 http://securitytracker.com/id?1014579 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101807-1 http://www.osvdb.org/18269 http://www.vupen.com/english/advisories/2005/1221 •