SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (UNIX)  >   Solaris Vendors:   Oracle, Sun
Oracle Solaris Lets Remote Users Deny Service and Local Users Gain Root Privileges
SecurityTracker Alert ID:  1026538
SecurityTracker URL:  http://securitytracker.com/id/1026538
CVE Reference:   CVE-2012-0094, CVE-2012-0096, CVE-2012-0097, CVE-2012-0098, CVE-2012-0099, CVE-2012-0100, CVE-2012-0103, CVE-2012-0109   (Links to External Site)
Date:  Jan 18 2012
Impact:   Denial of service via local system, Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, Root access via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 8, 9, 10, 11, Express
Description:   Multiple vulnerabilities were reported in Oracle Solaris. A local user can obtain elevated privileges on the target system. A remote user can cause denial of service conditions.

A remote user can send specially crafted TCP/IP data to cause target system to crash [CVE-2012-0094].

A remote user can send specially crafted RPC data to cause partial denial of service conditions [CVE-2012-0096].

A local user can exploit a flaw in the ksh93 shell to partially access data [CVE-2012-0097].

A local user can exploit a kernel flaw to cause partial denial of service conditions [CVE-2012-0098].

A remote user can send specially crafted data via SSH to cause partial denial of service conditions [CVE-2012-0099].

A local user can exploit a flaw in Kerberos to gain root privileges [CVE-2012-0100].

A local user can exploit a kernel flaw to cause the system to crash [CVE-2012-0103].

A local user can exploit a TCP/IP flaw to partially access data and partially deny service [CVE-2012-0109].

The following researchers reported these and other Oracle vulnerabilities:

An Anonymous Reporter of TippingPoint's Zero Day Initiative; Behrang Fouladi of SensePost Information Security; Chris Wysopal of Veracode; Clement Lecigne; Dennis Yurichev of McAfee Labs; Gorkem Yakin; InfoWorld; Juan Pablo Perez Etchegoyen of Onapsis; Mateusz "j00ru" Jurczyk; Michael Myngerbayev of McAfee Labs; Michael Oglesby of True Digital Security; Minetoshi Takizawa through JPCERT/CC Vulnerability Handling Team; Robert Maly of Ness Technologies; Rohan Stelling of Stratsec Research; and Will Dormann of CERT/CC.

Impact:   A local user can obtain root privileges on the target system.

A remote user can cause the target system to crash.

Solution:   The vendor has issued a fix, described in their January 2012 Critical Patch Update advisory.

The vendor's advisory is available at:

http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html

Vendor URL:  www.oracle.com/technetwork/topics/security/cpujan2012-366304.html (Links to External Site)
Cause:   Not specified

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC