CVE-2017-10099

Vulnerability in the SPARC M7, T7, S7 based Servers component of Oracle Sun Systems Products Suite (subcomponent: Firmware). The supported version that is affected is Prior to 9.7.6.b. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where SPARC M7, T7, S7 based Servers executes to compromise SPARC M7, T7, S7 based Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of SPARC M7, T7, S7 based Servers. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS v3 4.4 MEDIUM
CVSS v2.0 4.9 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	Patch Vendor Advisory
http://www.securityfocus.com/bid/101442	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:sparc-sun_system_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-10-19 17:29

Updated : 2024-02-28 16:04

NVD link : CVE-2017-10099

Mitre link : CVE-2017-10099

CVE.ORG link : CVE-2017-10099

JSON object : View

Products Affected

oracle

sparc-sun_system_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-10099", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2017-10-19T17:29:00.687", "references": [{"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "http://www.securityfocus.com/bid/101442", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the SPARC M7, T7, S7 based Servers component of Oracle Sun Systems Products Suite (subcomponent: Firmware). The supported version that is affected is Prior to 9.7.6.b. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where SPARC M7, T7, S7 based Servers executes to compromise SPARC M7, T7, S7 based Servers. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of SPARC M7, T7, S7 based Servers. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el componente Servers basado en SPARC M7, T7, S7 de Oracle Sun Systems Products Suite (subcomponente: Firmware). La versi\u00f3n compatible afectada es anterior a la 9.7.6.b. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante con un alto nivel de privilegios y con permisos de inicio de sesi\u00f3n en la infraestructura en la que se ejecutan los Servers basados en SPARC M7, T7, S7 comprometa la seguridad de los Servers basados en SPARC M7, T7, S7. Los ataques exitosos a esta vulnerabilidad pueden dar lugar a que el atacante consiga provocar el bloqueo o cierre inesperado, frecuente y repetido (DoS completo) de los Servers basado en SPARC M7, T7, S7. CVSS 3.0 Base Score 4.4 (impactos en la disponibilidad). Vector CVSS: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:sparc-sun_system_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAF5CF5A-A650-4DB2-A973-080517440C91", "versionEndIncluding": "9.7.5.e"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}