Vulnerabilities > CVE-2009-0838 - Resource Management Errors vulnerability in SUN Opensolaris and Sunos

047910
CVSS 4.9 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
local
low complexity
sun
CWE-399
nessus

Summary

The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv_88 through snv_102, does not properly free memory, which allows local users to cause a denial of service (panic) via unspecified vectors, related to the vmem_hash_delete function.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_139498.NASL
    descriptionSunOS 5.10: libpkcs11.so patch. Date this patch was last updated by Sun : Feb/26/09
    last seen2018-09-01
    modified2018-08-13
    plugin id36600
    published2009-04-23
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=36600
    titleSolaris 10 (sparc) : 139498-04
    code
    #%NASL_MIN_LEVEL 80502
    
    # @DEPRECATED@
    #
    # This script has been deprecated as the associated patch is not
    # currently a recommended security fix.
    #
    # Disabled on 2011/09/17.
    
    #
    # (C) Tenable Network Security, Inc.
    #
    #
    
    if ( ! defined_func("bn_random") ) exit(0);
    include("compat.inc");
    
    if(description)
    {
     script_id(36600);
     script_version("1.12");
    
     script_name(english: "Solaris 10 (sparc) : 139498-04");
     script_cve_id("CVE-2009-0838");
     script_set_attribute(attribute: "synopsis", value:
    "The remote host is missing Sun Security Patch number 139498-04");
     script_set_attribute(attribute: "description", value:
    'SunOS 5.10: libpkcs11.so patch.
    Date this patch was last updated by Sun : Feb/26/09');
     script_set_attribute(attribute: "solution", value:
    "You should install this patch for your system to be up-to-date.");
     script_set_attribute(attribute: "see_also", value:
    "https://getupdates.oracle.com/readme/139498-04");
     script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
     script_cwe_id(399);
     script_set_attribute(attribute:"plugin_publication_date", value: "2009/04/23");
     script_cvs_date("Date: 2019/10/25 13:36:25");
     script_end_attributes();
    
     script_summary(english: "Check for patch 139498-04");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
     family["english"] = "Solaris Local Security Checks";
     script_family(english:family["english"]);
     
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/Solaris/showrev");
     exit(0);
    }
    
    
    
    # Deprecated.
    exit(0, "The associated patch is not currently a recommended security fix.");
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS10_X86_139499.NASL
    descriptionSunOS 5.10_x86: libpkcs11.so patch. Date this patch was last updated by Sun : Feb/26/09
    last seen2018-09-01
    modified2018-08-13
    plugin id36512
    published2009-04-23
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=36512
    titleSolaris 10 (x86) : 139499-04
    code
    #%NASL_MIN_LEVEL 80502
    
    # @DEPRECATED@
    #
    # This script has been deprecated as the associated patch is not
    # currently a recommended security fix.
    #
    # Disabled on 2011/09/17.
    
    #
    # (C) Tenable Network Security, Inc.
    #
    #
    
    if ( ! defined_func("bn_random") ) exit(0);
    include("compat.inc");
    
    if(description)
    {
     script_id(36512);
     script_version("1.11");
    
     script_name(english: "Solaris 10 (x86) : 139499-04");
     script_cve_id("CVE-2009-0838");
     script_set_attribute(attribute: "synopsis", value:
    "The remote host is missing Sun Security Patch number 139499-04");
     script_set_attribute(attribute: "description", value:
    'SunOS 5.10_x86: libpkcs11.so patch.
    Date this patch was last updated by Sun : Feb/26/09');
     script_set_attribute(attribute: "solution", value:
    "You should install this patch for your system to be up-to-date.");
     script_set_attribute(attribute: "see_also", value:
    "https://getupdates.oracle.com/readme/139499-04");
     script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
     script_cwe_id(399);
     script_set_attribute(attribute:"plugin_publication_date", value: "2009/04/23");
     script_cvs_date("Date: 2019/10/25 13:36:25");
     script_end_attributes();
    
     script_summary(english: "Check for patch 139499-04");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
     family["english"] = "Solaris Local Security Checks";
     script_family(english:family["english"]);
     
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/Solaris/showrev");
     exit(0);
    }
    
    
    
    # Deprecated.
    exit(0, "The associated patch is not currently a recommended security fix.");
    

Oval

accepted2009-04-20T04:00:16.154-04:00
classvulnerability
contributors
namePai Peng
organizationHewlett-Packard
definition_extensions
  • commentSolaris 10 (SPARC) is installed
    ovaloval:org.mitre.oval:def:1440
  • commentSolaris 10 (x86) is installed
    ovaloval:org.mitre.oval:def:1926
descriptionThe crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv_88 through snv_102, does not properly free memory, which allows local users to cause a denial of service (panic) via unspecified vectors, related to the vmem_hash_delete function.
familyunix
idoval:org.mitre.oval:def:5641
statusaccepted
submitted2009-03-10T13:09:16.000-04:00
titleA Security Vulnerability With the Solaris Crypto Driver May Cause a System Panic
version35

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 34000 CVE(CAN) ID: CVE-2009-0838 Solaris是一款由Sun开发和维护的商业UNIX操作系统。 Solaris的加密伪设备驱动没有正确地释放内存,本地攻击者可以通过vmem_hash_delete函数导致系统忙碌。如果出现上述漏洞,系统可能出现类似于以下栈追踪的忙碌: vmem_hash_delete(): bad free vmem_hash_delete() vmem_xfree() object_get_attribute_value() fop_ioctl() ioctl() Sun Solaris 10.0_x86 Sun Solaris 10.0 Sun OpenSolaris snv_88 - snv_102 厂商补丁: Sun --- Sun已经为此发布了一个安全公告(Sun-Alert-254088)以及相应补丁: Sun-Alert-254088:A Security Vulnerability With the Solaris Crypto Driver May Cause a System Panic 链接:<a href=http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-254088-1 target=_blank rel=external nofollow>http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-66-254088-1</a>
idSSV:4882
last seen2017-11-19
modified2009-03-11
published2009-03-11
reporterRoot
titleSun Solaris加密驱动本地拒绝服务漏洞