Description: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). The supported version that is affected is 10. Easily “exploitable” vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Impact: A local attacker may exploit this issue to gain elevated...
Read More
Description: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). Easily “exploitable” vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. Impact: An attacker can exploit this issue to execute arbitrary code within...
Read More
Description: When determining tty, Sudo does not correctly parse the contents of /proc/[pid]/ stat, local attackers may use this method to overwrite any file on the file system, bypassing expected permissions or getting the root shell. Impact: Local attackers could exploit this issue to run arbitrary commands with root privileges. Sudo versions 1.8.6p7 through 1.8.20 are vulnerable. Mitigation: Updates are available. Please see the references...
Read More
Description: The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS. Impact: An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks. FreeRADIUS versions prior to 3.0.14 are vulnerable. Mitigation: Updates...
Read More
Description: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag. Impact: Attackers can exploit this issue to cause the kernel to enter into an infinite loop which may cause denial-of-service conditions. Mitigation: Updates are available. Please see the references...
Read More
