Sun Solaris NFS Sun Solaris NFS服务器内核模块本地拒绝服务漏洞

BUGTRAQ ID: 34031 CNCAN ID：CNCAN-2009030901 Sun Solaris是一款商业性质的操作系统。 Sun Solaris NFSv4服务器内核模块存在安全问题，如果服务器共享一个hsfs7FS文件系统 CD-ROM, DVD媒介，本地非特权用户可导致NFSv4服务器挂起。 目前没有详细漏洞细节提供 Sun Solaris 10x86 Sun Solaris 10.0 Sun OpenSolaris build snv99 Sun OpenSolaris build snv96 Sun OpenSolaris build snv95 Sun...

Sun Solaris加密驱动本地拒绝服务漏洞

BUGTRAQ ID: 34000 CVECAN ID: CVE-2009-0838 Solaris是一款由Sun开发和维护的商业UNIX操作系统。 Solaris的加密伪设备驱动没有正确地释放内存，本地攻击者可以通过vmemhashdelete函数导致系统忙碌。如果出现上述漏洞，系统可能出现类似于以下栈追踪的忙碌： vmemhashdelete: bad free vmemhashdelete vmemxfree objectgetattributevalue fopioctl ioctl Sun Solaris 10.0x86 Sun Solaris 10.0 Sun...

Design/Logic Flaw

The NFSv4 Server module in the kernel in Sun Solaris 10, and OpenSolaris before snv111, allow local users to cause a denial of service infinite loop and system hang by accessing an hsfs filesystem that is shared through NFSv4, related to the rfs4opreaddir function...

CVE-2009-0870

CVE-2009-0870 affects Sun Solaris 10 (and OpenSolaris before snv_111) where the NFSv4 Server kernel module can cause a denial of service (infinite loop and system hang) by accessing an hsfs filesystem shared via NFSv4, due to the rfs4_op_readdir path. Affected platforms include Solaris 10 SPARC a...

Sun xVM VirtualBox 2.02.1 - Local Privilege Escalation

Sun xVM VirtualBox 2.02.1 - Local Privilege Escalation source: https://www.securityfocus.com/bid/34080/info Sun xVM VirtualBox is prone to a local privilege-escalation vulnerability. An attacker can exploit this vulnerability to run arbitrary code with superuser privileges. The following versions...

Sun xVM VirtualBox 2.0/2.1 - Local Privilege Escalation

source: https://www.securityfocus.com/bid/34080/info Sun xVM VirtualBox is prone to a local privilege-escalation vulnerability. An attacker can exploit this vulnerability to run arbitrary code with superuser privileges. The following versions for the Linux platform are vulnerable: Sun xVM...

CVE-2009-0857

Cross-site scripting XSS vulnerability in /prm/reports in the Performance Reporting Module PRM for Sun Management Center SunMC 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console...

Cross site scripting

Cross-site scripting XSS vulnerability in /prm/reports in the Performance Reporting Module PRM for Sun Management Center SunMC 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console...

CVE-2009-0857

The CVE-2009-0857 entry describes a Cross-site scripting (XSS) vulnerability in Sun Management Center (SunMC) Performance Reporting Module (PRM) affecting PRM 3.6.1 and 4.0, exploitable via the msg parameter in /prm/reports and potentially enabling access to the SunMC Web Console. Connected docum...

CVE-2009-0857

Cross-site scripting XSS vulnerability in /prm/reports in the Performance Reporting Module PRM for Sun Management Center SunMC 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: this can be leveraged for access to the SunMC Web Console...

CVE-2009-0838

The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv88 through snv102, does not properly free memory, which allows local users to cause a denial of service panic via unspecified vectors, related to the vmemhashdelete function...

Design/Logic Flaw

The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv88 through snv102, does not properly free memory, which allows local users to cause a denial of service panic via unspecified vectors, related to the vmemhashdelete function...

CVE-2009-0838

The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv88 through snv102, does not properly free memory, which allows local users to cause a denial of service panic via unspecified vectors, related to the vmemhashdelete function...

CVE-2009-0838

The CVE-2009-0838 issue affects Sun Solaris 10 and OpenSolaris builds snv_88 through snv_102, where the crypto pseudo device driver fails to free memory. This can enable local attackers to trigger a denial-of-service (panic) via the vmem_hash_delete path. Public details in connected records confi...

Sun管理中心性能报表模块跨站脚本漏洞

BUGTRAQ ID: 33999 Sun Management Center软件是开放的、可扩展的系统监视和管理方案。 Sun管理中心的性能报表模块中存在跨站脚本漏洞，可能允许远程非特权用户在用户浏览器中执行任意JavaScript代码，或窃取可能用于访问Sun管理中心Web控制台的会话cookie。 Sun SunMC 4.0 Sun SunMC 3.6.1 厂商补丁： Sun --- Sun已经为此发布了一个安全公告（Sun-Alert-247046）以及相应补丁: Sun-Alert-247046：Cross Site Scripting XSS Vulnerability in...

Java Runtime Environment JAR manifest Main Class buffer overflow

Added: 02/26/2009 CVE: CVE-2008-5354 BID: 32608 OSVDB: 50499 Background Java Runtime Environment JRE allows end users to run Java applications. Problem A buffer overflow vulnerability in JRE allows command execution when a user opens a JAR archive containing a manifest file with a specially craft...

Java Runtime Environment JAR manifest Main Class buffer overflow

Added: 02/26/2009 CVE: CVE-2008-5354 BID: 32608 OSVDB: 50499 Background Java Runtime Environment JRE allows end users to run Java applications. Problem A buffer overflow vulnerability in JRE allows command execution when a user opens a JAR archive containing a manifest file with a specially craft...

CVE-2008-6192

Multiple cross-site scripting XSS vulnerabilities in unspecified Portlets in Sun Java System Portal Server 7.0 and 7.1 allow remote attackers to inject arbitrary web script or HTML via unknown vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in unspecified Portlets in Sun Java System Portal Server 7.0 and 7.1 allow remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2008-6192

CVE-2008-6192 describes multiple XSS vulnerabilities in unspecified Portlets of Sun Java System Portal Server 7.0 and 7.1. The initial description notes remote injection of arbitrary scripts via unknown vectors, without concrete exploit details. Connected documents include Solaris patch reference...