The NFS server in Sun Solaris 10, and OpenSolaris before snv_111, does not properly implement the AUTH_NONE (aka sec=none) security mode in combination with other security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the AUTH_NONE and AUTH_SYS security modes.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 01:01
Type | Values Removed | Values Added |
---|---|---|
References | () http://osvdb.org/52559 - | |
References | () http://secunia.com/advisories/34213 - Vendor Advisory | |
References | () http://secunia.com/advisories/34429 - | |
References | () http://securitytracker.com/id?1021833 - | |
References | () http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1 - Patch | |
References | () http://sunsolve.sun.com/search/document.do?assetkey=1-66-253588-1 - Patch, Vendor Advisory | |
References | () http://support.avaya.com/elmodocs2/security/ASA-2009-093.htm - | |
References | () http://www.securityfocus.com/bid/34063 - Exploit | |
References | () http://www.vupen.com/english/advisories/2009/0658 - Vendor Advisory | |
References | () http://www.vupen.com/english/advisories/2009/0798 - | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/49170 - |
Information
Published : 2009-03-11 14:19
Updated : 2024-11-21 01:01
NVD link : CVE-2009-0872
Mitre link : CVE-2009-0872
CVE.ORG link : CVE-2009-0872
JSON object : View
Products Affected
sun
- solaris
- opensolaris
CWE
CWE-264
Permissions, Privileges, and Access Controls