CVE-2019-3010Oracle Solaris Privilege Escalation Vulnerability
Aktif olarak istismar ediliyor — Oracle Solaris Privilege Escalation Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.05.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.06.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-3010
Açıklama
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| oracle | solaris | 11 | |
| Oracle Corporation | Solaris Operating System | 11 |
Kaynaklar ve yamalar
- http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html PatchVendor Advisory
- 20191018 CVE-2019-3010 - Local privilege escalation on Solaris 11.x via xscreensaver mailing-listMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/154960/Solaris-xscreensaver-Privilege-Escalation.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3010 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*