CVSS: 4.6EPSS: 0%CPEs: 10EXPL: 0CVE-2003-1575
https://notcve.org/view.php?id=CVE-2003-1575
VERITAS File System (VxFS) 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass intended file permissions by accessing a file on a VxFS filesystem. VERITAS File System (VxFS) v3.3.3, v3.4, y v3.5 anterior a MP1 Rolling Patch 02 para Sun Solaris v2.5.1 a la v9, no implementa adecuadamente la herencia de las ACLs por defecto en determinadas circunstancias relacionadas con las características de un directorio inode, lo que permite a usuarios locales evitar las restricciones de acceso a archivos establecidas accediendo a un archivo sobre un sistema de ficheros VxFS. • http://sunsolve.sun.com/search/document.do?assetkey=1-21-113207-05-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200161-1 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 7EXPL: 0CVE-2009-2314
https://notcve.org/view.php?id=CVE-2009-2314
Race condition in the Sun Lightweight Availability Collection Tool 3.0 on Solaris 7 through 10 allows local users to overwrite arbitrary files via unspecified vectors. Condición de carrera en la Sun Lightweight Availability Collection Tool v3.0 de Solaris 7 hasta 10 , permite a usuarios locales sobrescribir ficheros de su elección a través de vectores no especificados. • http://osvdb.org/55559 http://secunia.com/advisories/35707 http://sunsolve.sun.com/search/document.do?assetkey=1-66-261408-1 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020599.1-1 http://www.securityfocus.com/bid/35568 http://www.securitytracker.com/id?1022510 http://www.vupen.com/english/advisories/2009/1772 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.1EPSS: 2%CPEs: 2049EXPL: 0CVE-2008-4609
https://notcve.org/view.php?id=CVE-2008-4609
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. La implementación del protocolo TCP en (1) Linux, (2) plataformas basadas en BSD Unix, (3) Microsoft Windows, (4) productos Cisco, y probablemente otros sistemas operativos, permite a atacantes remotos provocar una denegación de servicio (agotamiento de cola de conexión) a través de múltiples vectores que manipulan información en la tabla de estados del TCP, como lo demuestra sockstress. • http://blog.robertlee.name/2008/10/conjecture-speculation.html http://insecure.org/stf/tcp-dos-attack-explained.html http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html http://marc.info/?l=bugtraq&m=125856010926699&w=2 http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html http://www.cpni • CWE-16: Configuration •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 1CVE-2008-2710
https://notcve.org/view.php?id=CVE-2008-2710
Integer signedness error in the ip_set_srcfilter function in the IP Multicast Filter in uts/common/inet/ip/ip_multi.c in the kernel in Sun Solaris 10 and OpenSolaris before snv_92 allows local users to execute arbitrary code in other Solaris Zones via an SIOCSIPMSFILTER IOCTL request with a large value of the imsf->imsf_numsrc field, which triggers an out-of-bounds write of kernel memory. NOTE: this was reported as an integer overflow, but the root cause involves the bypass of a signed comparison. Error de presencia de signo entero en la función ip_set_srcfilter en el IP Multicast Filter en uts/common/inet/ip/ip_multi.c en el kernel de Sun Solaris 10 y OpenSolaris anterior a snv_92, permite a usuarios locales ejecutar código de su elección en otras "Solaris Zones" a través de una petición SIOCSIPMSFILTER IOCTL con un valor largo del campo imsf->imsf_numsrc, que dispara una escritura de memoria del kernel fuera de rango. NOTA: esto ha sido reportado como un desbordamiento de entero, pero el origen del problema implica una comparación de signo que no se realiza. • http://secunia.com/advisories/30693 http://sunsolve.sun.com/search/document.do?assetkey=1-26-237965-1 http://www.securityfocus.com/bid/29699 http://www.securitytracker.com/id?1020283 http://www.trapkit.de/advisories/TKADV2008-003.txt http://www.vupen.com/english/advisories/2008/1832/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43068 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5731 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 96%CPEs: 9EXPL: 2CVE-2005-4797 – Solaris LPD Arbitrary File Delete
https://notcve.org/view.php?id=CVE-2005-4797
Directory traversal vulnerability in printd line printer daemon (lpd) in Solaris 7 through 10 allows remote attackers to delete arbitrary files via ".." sequences in an "Unlink data file" command. • http://downloads.securityfocus.com/vulnerabilities/exploits/solaris_lpd_unlink.pm http://secunia.com/advisories/16367 http://securitytracker.com/id?1014635 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101842-1 http://www.ciac.org/ciac/bulletins/p-280.shtml http://www.osvdb.org/18650 http://www.securityfocus.com/bid/14510 http://www.vupen.com/english/advisories/2005/1342 https://exchange.xforce.ibmcloud.com/vulnerabilities/21773 •