CVE-2020-14871

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Recent assessments:

busterb at November 02, 2020 11:12pm UTC reported:

Likely pre-auth RCE via stack overflow in PAM username parsing. Simply provide an overlong username, and PAM does an over copy into a stack buffer.

Bug being discussed in open source offshoots for Solaris here: <https://illumos.topicbox.com/groups/developer/T4da539ebf8f90156/urgent-cve-2020-14871&gt;

But they’re not sure if it’s actually related to this commit <https://github.com/illumos/illumos-gate/commit/1d276e0b382cf066dae93640746d8b4c54d15452&gt;, or if it’s a different bug. My money is on the former. <https://www.illumos.org/issues/13242&gt;

ZDNet article referencing exploitation in the wild: <https://www.zdnet.com/article/hacker-group-uses-solaris-zero-day-to-breach-corporate-networks/&gt;

wvu-r7 at November 05, 2020 1:41am UTC reported:

Likely pre-auth RCE via stack overflow in PAM username parsing. Simply provide an overlong username, and PAM does an over copy into a stack buffer.

Bug being discussed in open source offshoots for Solaris here: <https://illumos.topicbox.com/groups/developer/T4da539ebf8f90156/urgent-cve-2020-14871&gt;

But they’re not sure if it’s actually related to this commit <https://github.com/illumos/illumos-gate/commit/1d276e0b382cf066dae93640746d8b4c54d15452&gt;, or if it’s a different bug. My money is on the former. <https://www.illumos.org/issues/13242&gt;

ZDNet article referencing exploitation in the wild: <https://www.zdnet.com/article/hacker-group-uses-solaris-zero-day-to-breach-corporate-networks/&gt;

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 4