Vulnerabilities > CVE-2003-0027 - Unspecified vulnerability in SUN Solaris and Sunos

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
sun
metasploit
NVD
Published: 2003-02-07
Updated: 2018-10-30

Summary

Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.

Vulnerable Configurations

Part Description Count
OS
Sun
10

Metasploit

descriptionThis module targets a directory traversal vulnerability in the kcms_server component from the Kodak Color Management System. By utilizing the ToolTalk Database Server\'s TT_ISBUILD procedure, an attacker can bypass existing directory traversal validation and read arbitrary files. Vulnerable systems include Solaris 2.5 - 9 SPARC and x86. Both kcms_server and rpc.ttdbserverd must be running on the target host.
idMSF:AUXILIARY/ADMIN/SUNRPC/SOLARIS_KCMS_READFILE
last seen2020-05-23
modified2019-10-05
published2010-06-24
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb
titleSolaris KCMS + TTDB Arbitrary File Read

Oval

  • accepted2007-04-25T19:52:14.919-04:00
    classvulnerability
    contributors
    • nameDavid Proulx
      organizationThe MITRE Corporation
    • nameTodd Dolinsky
      organizationOpsware, Inc.
    • nameDragos Prisaca
      organizationSecure Elements, Inc.
    • nameJonathan Baker
      organizationThe MITRE Corporation
    descriptionDirectory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.
    familyunix
    idoval:org.mitre.oval:def:120
    statusdeprecated
    submitted2003-01-30T12:00:00.000-04:00
    titleSolaris 7 KCMS Arbitrary File Access Vulnerability
    version36
  • accepted2007-04-25T19:52:21.718-04:00
    classvulnerability
    contributors
    • nameDavid Proulx
      organizationThe MITRE Corporation
    • nameTodd Dolinsky
      organizationOpsware, Inc.
    • nameDragos Prisaca
      organizationSecure Elements, Inc.
    • nameJonathan Baker
      organizationThe MITRE Corporation
    descriptionDirectory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.
    familyunix
    idoval:org.mitre.oval:def:195
    statusdeprecated
    submitted2003-01-24T12:00:00.000-04:00
    titleSolaris 8 KCMS Arbitrary File Access Vulnerability
    version36
  • accepted2010-09-20T04:00:20.237-04:00
    classvulnerability
    contributors
    • nameBrian Soby
      organizationThe MITRE Corporation
    • nameTodd Dolinsky
      organizationOpsware, Inc.
    • nameDragos Prisaca
      organizationSecure Elements, Inc.
    • nameJonathan Baker
      organizationThe MITRE Corporation
    descriptionDirectory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.
    familyunix
    idoval:org.mitre.oval:def:2592
    statusaccepted
    submitted2005-01-19T12:00:00.000-04:00
    titleKCMS KCS_OPEN_PROFILE File Disclosure Vulnerability
    version39

References