Oracle Solaris 10/11 Pluggable authentication module parse_user_name stack-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in Oracle Solaris 10/11. Affected by this issue is the function parse_user_name of the component Pluggable authentication module. The manipulation results in stack-based overflow. This vulnerability is reported as CVE-2020-14871. The attack can be launched remotely. Moreover, an exploit is present. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Oracle Solaris 10/11 (Operating System). Affected is the function parse_user_name of the component Pluggable authentication module. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

The weakness was disclosed 10/20/2020 as Oracle Critical Patch Update Advisory - October 2020. The advisory is available at oracle.com. This vulnerability is traded as CVE-2020-14871. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/27/2025). It is expected to see the exploit prices for this product decreasing in the near future.

A public exploit has been developed by hackerfantastic in C and been published 3 weeks after the advisory. The exploit is shared for download at github.com. It is declared as attacked. As 0-day the estimated underground price was around $25k-$100k. This issue was added on 11/03/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/03/2022:

Apply updates per vendor instructions.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (49261) and Zero-Day.cz (589). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Oracle

Name

• Solaris

Version

• 10
• 11

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

Screenshot

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion