CVE-2009-3746

XScreenSaver in Sun Solaris 10, when the accessibility feature is enabled, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different vulnerability than CVE-2009-1276 and CVE-2009-2711.

CVSS v2.0 1.9 LOW

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-29-1	Patch Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-268288-1	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6644
http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-29-1	Patch Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-268288-1	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6644

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:sun:solaris:10::sparc:::::
	cpe:2.3:o:sun:solaris:10::x86:::::

History

21 Nov 2024, 01:08

Type	Values Removed	Values Added
References	~~() http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-29-1 - Patch, Vendor Advisory~~	() http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-29-1 - Patch, Vendor Advisory
References	~~() http://sunsolve.sun.com/search/document.do?assetkey=1-66-268288-1 - Patch, Vendor Advisory~~	() http://sunsolve.sun.com/search/document.do?assetkey=1-66-268288-1 - Patch, Vendor Advisory
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6644 -~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6644 -

Information

Published : 2009-10-22 16:30

Updated : 2024-11-21 01:08

NVD link : CVE-2009-3746

Mitre link : CVE-2009-3746

CVE.ORG link : CVE-2009-3746

JSON object : View

Products Affected

sun

solaris

CWE

CWE-16

Configuration

{"id": "CVE-2009-3746", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-10-22T16:30:00.313", "references": [{"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-29-1", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-268288-1", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6644", "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-29-1", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-268288-1", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6644", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-16"}]}], "descriptions": [{"lang": "en", "value": "XScreenSaver in Sun Solaris 10, when the accessibility feature is enabled, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different vulnerability than CVE-2009-1276 and CVE-2009-2711."}, {"lang": "es", "value": "XScreenSaver de Sun Solaris 10, cuando la caracter\u00edstica de accesibilidad est\u00e1 habilitada, permite a atacantes cercanos f\u00edsicamente obtener informaci\u00f3n sensible leyendo las ventanas emergentes que se muestran incluso con el monitor bloqueado. Se trata de una vulnerabilidad diferente de CVE-2009-1276 y CVE-2009-2711."}], "lastModified": "2024-11-21T01:08:06.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sun:solaris:10:*:sparc:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FBA68F0-4577-46F5-A754-D365B6EFF872"}, {"criteria": "cpe:2.3:o:sun:solaris:10:*:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E79CFAA6-A08A-4C70-A3D9-B02C29A17FF2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}