Sun Lightweight Availability Collection Tool up to 3.0 race condition
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
3.6 | $0-$5k | 0.00 |
A vulnerability was found in Sun Lightweight Availability Collection Tool up to 3.0. It has been declared as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect integrity. The summary by CVE is:
Race condition in the Sun Lightweight Availability Collection Tool 3.0 on Solaris 7 through 10 allows local users to overwrite arbitrary files via unspecified vectors.
The weakness was shared 07/02/2009 by Mike (Website). It is possible to read the advisory at sunsolve.sun.com. This vulnerability is known as CVE-2009-2314 since 07/05/2009. The exploitation appears to be easy. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.
It is declared as proof-of-concept.
Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.
Product
Vendor
Name
Version
License
Support
- end of life
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.0VulDB Meta Temp Score: 3.6
VulDB Base Score: 4.0
VulDB Temp Score: 3.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Race conditionCWE: CWE-362
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Proof-of-Concept
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Timeline
07/02/2009 🔍07/02/2009 🔍
07/02/2009 🔍
07/03/2009 🔍
07/03/2009 🔍
07/03/2009 🔍
07/05/2009 🔍
07/05/2009 🔍
03/17/2015 🔍
12/10/2017 🔍
Sources
Vendor: oracle.comAdvisory: sunsolve.sun.com⛔
Researcher: Mike
Status: Confirmed
CVE: CVE-2009-2314 (🔍)
SecurityTracker: 1022510
SecurityFocus: 35568 - Sun Lightweight Availability Collection Tool File Overwrite Vulnerability
Secunia: 35707 - Sun Lightweight Availability Collection Tool File Overwrite Vulnerability, Not Critical
OSVDB: 55559 - Sun Lightweight Availability Collection Tool Race Condition Arbitrary File Overwrite
Vupen: ADV-2009-1772
Entry
Created: 03/17/2015 23:38Updated: 12/10/2017 09:53
Changes: 03/17/2015 23:38 (57), 12/10/2017 09:53 (8)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.