Executive Summary

Summary
Title Sun Alert 244026 Security Vulnerability in the Process File System (proc(4)) Relating to Contract File System (contract(4)) Interaction May Lead to a System Panic or Possible Execution of Arbitrary Code by Unprivileged Users
Informations
Name SUN-244026 First vendor Publication 2009-02-05
Vendor Sun Last vendor Modification 2009-02-05
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: OpenSolaris

A security vulnerability in the process file system (proc(4)) when interacting with the contract(4) file system may allow a local unprivileged user the ability to panic the system or execute arbitrary commands with all (super-user) privileges. The ability to panic a system is a type of Denial of Service (DoS).

Sun acknowledges with thanks, Ilja van Sprundel from IOActive for bringing this issue to our attention.

This issue is also referenced in the following IOActive advisory:
State: Resolved
First released: 05-Feb-2009
Sun Alert Link:http://sunsolve.sun.com/search/document.do?assetkey=1-66-244026-1

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_244026_security_vulnerability

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 32

Open Source Vulnerability Database (OSVDB)

Id Description
52512 Solaris Process File System (proc(4)) Contract File System (contract(4)) Inte...