CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SUN » Solaris : Security Vulnerabilities (CVSS score >= 9)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complex ity Authen tication Confiden tiality Integrity Availa bility
1 CVE-2009-2296 2009-07-02 2010-12-10
10.0
 None Remote Low Not required Complete Complete Complete
The NFSv4 server kernel module in Sun Solaris 10, and OpenSolaris before snv_119, does not properly implement the nfs_portmon setting, which allows remote attackers to access shares, and read, create, and modify arbitrary files, via unspecified vectors.
2 CVE-2008-5010 DoS 2008-11-10 2009-03-13
10.0
 Admin Remote Low Not required Complete Complete Complete
in.dhcpd in the DHCP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unknown DHCP requests related to the "number of offers," aka Bug ID 6713805.
3 CVE-2008-4619 1 DoS 2008-10-20 2009-01-29
10.0
 Admin Remote Low Not required Complete Complete Complete
The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8 in program 100000 (rpcbind), related to the XDR_DECODE operation and the taddr2uaddr function. NOTE: this might be a duplicate of CVE-2007-0165.
4 CVE-2008-4556 119 1 Exec Code Overflow 2008-10-14 2010-08-21
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted request.
5 CVE-2008-3870 189 Exec Code Overflow 2009-05-26 2010-08-21
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request that triggers a heap-based buffer overflow, related to improper memory allocation.
6 CVE-2008-3869 119 Exec Code Overflow 2009-05-26 2010-08-21
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request, related to improper decoding of request parameters.
7 CVE-2008-2144 DoS Exec Code 2008-05-12 2009-04-02
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8, 9, and 10 allow remote attackers to cause a denial of service or execute arbitrary code via unknown vectors.
8 CVE-2008-1369 264 +Priv 2008-03-18 2009-04-01
10.0
 Admin Remote Low Not required Complete Complete Complete
A certain incorrect Sun Solaris 10 image on SPARC Enterprise T5120 and T5220 servers has /etc/default/login and /etc/ssh/sshd_config files that configure root logins in a manner unintended by the vendor, which allows remote attackers to gain privileges via unspecified vectors.
9 CVE-2008-0965 134 Exec Code 2008-08-08 2011-04-07
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet.
10 CVE-2008-0964 119 1 Exec Code Overflow 2008-08-08 2009-03-18
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via a crafted SMB packet.
11 CVE-2007-6413 264 Bypass 2007-12-17 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
Sun Solaris 10 with the 120011-04 and 120012-04 patches, and later 120011-* and 120012-* patches, allows remote attackers to bypass certain netgroup restrictions and obtain root access to a filesystem via NFS requests from a client root user.
12 CVE-2007-3094 Exec Code 2007-06-06 2008-09-05
9.0
 Admin Remote Low Single system Complete Complete Complete
Unspecified vulnerability in the authentication mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote authenticated users to execute arbitrary code via unspecified vectors, related to the WBEM server.
13 CVE-2007-3093 Exec Code 2007-06-06 2008-11-15
10.0
 Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the logging mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote attackers to execute arbitrary code via unspecified vectors, related to the WBEM server.
14 CVE-2007-0882 94 2007-02-12 2011-06-13
10.0
 Admin Remote Low Not required Complete Complete Complete
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.
15 CVE-2004-1351 Exec Code 2004-12-07 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.
16 CVE-2004-0523 Exec Code Overflow 2004-08-18 2010-08-21
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
17 CVE-2003-1081 2003-09-09 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Aspppls for Solaris 8 allows local users to overwrite arbitrary files via a symlink attack on the .asppp.fifo temporary file.
18 CVE-2003-0722 +Priv 2003-09-22 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets.
19 CVE-2003-0694 Exec Code Overflow 2003-10-06 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.
20 CVE-2003-0466 Exec Code Overflow 2003-08-27 2010-05-25
10.0
 Admin Remote Low Not required Complete Complete Complete
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
21 CVE-2003-0201 Exec Code Overflow 2003-05-05 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.
22 CVE-2003-0196 DoS Exec Code Overflow 2003-05-05 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Samba before 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service, as discovered by the Samba team and a different vulnerability than CVE-2003-0201.
23 CVE-2003-0161 DoS Exec Code Overflow 2003-04-02 2010-05-25
10.0
 Admin Remote Low Not required Complete Complete Complete
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
24 CVE-2002-1584 +Priv 2002-12-27 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Unknown vulnerability in the AUTH_DES authentication for RPC in Solaris 2.5.1, 2.6, and 7, SGI IRIX 6.5 to 6.5.19f, and possibly other platforms, allows remote attackers to gain privileges.
25 CVE-2002-1337 Exec Code Overflow 2003-03-07 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
26 CVE-2002-0797 Overflow +Priv 2002-08-12 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.
27 CVE-2002-0796 +Priv 2002-08-12 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges.
28 CVE-2002-0679 Exec Code Overflow 2002-09-05 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure.
29 CVE-2002-0436 Exec Code 2002-07-26 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.
30 CVE-2002-0391 Exec Code Overflow Bypass 2002-08-12 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
31 CVE-2002-0033 Exec Code Overflow 2002-05-29 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.
32 CVE-2001-1583 Exec Code 2001-12-31 2010-06-24
10.0
 Admin Remote Low Not required Complete Complete Complete
lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220.
33 CVE-2001-0797 Exec Code Overflow 2001-12-12 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
34 CVE-2001-0779 Overflow 2001-10-18 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username.
35 CVE-2001-0554 Exec Code Overflow 2001-08-14 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
36 CVE-2001-0353 Overflow +Priv 2001-07-21 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in the line printer daemon (in.lpd) for Solaris 8 and earlier allows local and remote attackers to gain root privileges via a "transfer job" routine.
37 CVE-2001-0269 Bypass 2001-05-03 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
pam_ldap authentication module in Solaris 8 allows remote attackers to bypass authentication via a NULL password.
38 CVE-2001-0249 Exec Code Overflow 2001-06-18 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Heap overflow in FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to generate long strings.
39 CVE-2001-0236 Exec Code Overflow 2001-05-03 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Solaris snmpXdmid SNMP to DMI mapper daemon allows remote attackers to execute arbitrary commands via a long "indication" event.
40 CVE-2000-0844 264 Exec Code 2000-11-14 2009-01-20
10.0
 Admin Remote Low Not required Complete Complete Complete
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.
41 CVE-2000-0032 1999-12-22 2008-09-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Solaris dmi_cmd allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database.
42 CVE-1999-1588 1 Exec Code Overflow 1999-12-31 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka System V listener) port, TCP port 2766.
43 CVE-1999-0977 Overflow +Priv 1999-12-10 2008-09-09
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Solaris sadmind allows remote attackers to gain root privileges using a NETMGT_PROC_SERVICE request.
44 CVE-1999-0974 Overflow +Priv 1999-12-09 2008-09-09
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Solaris snoop allows remote attackers to gain root privileges via GETQUOTA requests to the rpc.rquotad service.
45 CVE-1999-0973 Overflow +Priv 1999-12-07 2008-09-09
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Solaris snoop program allows remote attackers to gain root privileges via a long domain name when snoop is running in verbose mode.
46 CVE-1999-0837 DoS 1999-11-10 2008-09-09
10.0
 Admin Remote Low Not required Complete Complete Complete
Denial of service in BIND by improperly closing TCP sessions via so_linger.
47 CVE-1999-0835 DoS 1999-11-10 2008-09-09
10.0
 Admin Remote Low Not required Complete Complete Complete
Denial of service in BIND named via malformed SIG records.
48 CVE-1999-0696 Overflow 1999-07-01 2008-09-09
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd).
49 CVE-1999-0568 1999-01-01 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
rpc.admind in Solaris is not running in a secure mode.
50 CVE-1999-0320 1998-03-01 2008-09-09
9.3
 Admin Remote Medium Not required Complete Complete Complete
SunOS rpc.cmsd allows attackers to obtain root access by overwriting arbitrary files.
Total number of vulnerabilities : 64   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.