National Cyber Awareness System

Vulnerability Summary for CVE-2009-0873

Overview

The NFS daemon (aka nfsd) in Sun Solaris 10 and OpenSolaris before snv_106, when NFSv3 is used, does not properly implement combinations of security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the sec=sys and sec=krb5 security modes, related to modes that "override each other."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SUNALERT

Name: 250306

Type: Advisory; Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-250306-1

External Source: CONFIRM

Name: http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1

Type: Advisory; Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1

External Source: XF

Name: solaris-nfsd-unauthorized-access(49171)

Hyperlink:http://xforce.iss.net/xforce/xfdb/49171

External Source: VUPEN

Name: ADV-2009-0814

Hyperlink:http://www.vupen.com/english/advisories/2009/0814

External Source: VUPEN

Name: ADV-2009-0657

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/0657

External Source: BID

Name: 34062

Hyperlink:http://www.securityfocus.com/bid/34062

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2009-096.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2009-096.htm

External Source: SECTRACK

Name: 1021832

Hyperlink:http://securitytracker.com/id?1021832

External Source: SECUNIA

Name: 34435

Hyperlink:http://secunia.com/advisories/34435

External Source: SECUNIA

Name: 34225

Type: Advisory

Hyperlink:http://secunia.com/advisories/34225

External Source: OSVDB

Name: 52560

Hyperlink:http://osvdb.org/52560