CVSS: 4.6EPSS: 0%CPEs: 10EXPL: 0CVE-2003-1575
https://notcve.org/view.php?id=CVE-2003-1575
VERITAS File System (VxFS) 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass intended file permissions by accessing a file on a VxFS filesystem. VERITAS File System (VxFS) v3.3.3, v3.4, y v3.5 anterior a MP1 Rolling Patch 02 para Sun Solaris v2.5.1 a la v9, no implementa adecuadamente la herencia de las ACLs por defecto en determinadas circunstancias relacionadas con las características de un directorio inode, lo que permite a usuarios locales evitar las restricciones de acceso a archivos establecidas accediendo a un archivo sobre un sistema de ficheros VxFS. • http://sunsolve.sun.com/search/document.do?assetkey=1-21-113207-05-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200161-1 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 2%CPEs: 2049EXPL: 0CVE-2008-4609
https://notcve.org/view.php?id=CVE-2008-4609
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. La implementación del protocolo TCP en (1) Linux, (2) plataformas basadas en BSD Unix, (3) Microsoft Windows, (4) productos Cisco, y probablemente otros sistemas operativos, permite a atacantes remotos provocar una denegación de servicio (agotamiento de cola de conexión) a través de múltiples vectores que manipulan información en la tabla de estados del TCP, como lo demuestra sockstress. • http://blog.robertlee.name/2008/10/conjecture-speculation.html http://insecure.org/stf/tcp-dos-attack-explained.html http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html http://marc.info/?l=bugtraq&m=125856010926699&w=2 http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html http://www.cpni • CWE-16: Configuration •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 1CVE-2008-2710
https://notcve.org/view.php?id=CVE-2008-2710
Integer signedness error in the ip_set_srcfilter function in the IP Multicast Filter in uts/common/inet/ip/ip_multi.c in the kernel in Sun Solaris 10 and OpenSolaris before snv_92 allows local users to execute arbitrary code in other Solaris Zones via an SIOCSIPMSFILTER IOCTL request with a large value of the imsf->imsf_numsrc field, which triggers an out-of-bounds write of kernel memory. NOTE: this was reported as an integer overflow, but the root cause involves the bypass of a signed comparison. Error de presencia de signo entero en la función ip_set_srcfilter en el IP Multicast Filter en uts/common/inet/ip/ip_multi.c en el kernel de Sun Solaris 10 y OpenSolaris anterior a snv_92, permite a usuarios locales ejecutar código de su elección en otras "Solaris Zones" a través de una petición SIOCSIPMSFILTER IOCTL con un valor largo del campo imsf->imsf_numsrc, que dispara una escritura de memoria del kernel fuera de rango. NOTA: esto ha sido reportado como un desbordamiento de entero, pero el origen del problema implica una comparación de signo que no se realiza. • http://secunia.com/advisories/30693 http://sunsolve.sun.com/search/document.do?assetkey=1-26-237965-1 http://www.securityfocus.com/bid/29699 http://www.securitytracker.com/id?1020283 http://www.trapkit.de/advisories/TKADV2008-003.txt http://www.vupen.com/english/advisories/2008/1832/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43068 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5731 • CWE-189: Numeric Errors •
CVSS: 3.6EPSS: 0%CPEs: 14EXPL: 0CVE-2005-4796
https://notcve.org/view.php?id=CVE-2005-4796
Unspecified vulnerability in the XView library (libxview.so) in Solaris 2.5 to 10 allows local users to corrupt files via unknown vectors related to the handling of the clipboard selection while an XView application exits. • http://sunsolve.sun.com/search/document.do?assetkey=1-26-100881-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-27525-1 http://www.ciac.org/ciac/bulletins/p-264.shtml http://www.osvdb.org/18809 http://www.securityfocus.com/bid/13016 •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 2CVE-2004-2686 – Sun Solaris 2.6/7.0/8/9 - vfs_getvfssw function Privilege Escalation
https://notcve.org/view.php?id=CVE-2004-2686
Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure. • https://www.exploit-db.com/exploits/23874 http://seclists.org/bugtraq/2004/Apr/0081.html http://securitytracker.com/id?1008833 http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2004-04/0297.html http://www.immunitysec.com/downloads/solaris_kernel_vfs.sxw.pdf http://www.securityfocus.com/bid/9962 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1381 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •