Sun Solaris 2.6/7.0/8.0 mibiisa memory corruption

Summaryinfo

A vulnerability was found in Sun Solaris 2.6/7.0/8.0. It has been rated as critical. Impacted is an unknown function of the component mibiisa. The manipulation leads to memory corruption. This vulnerability is listed as CVE-2002-0797. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in Sun Solaris 2.6/7.0/8.0 (Operating System). It has been rated as very critical. This issue affects an unknown function of the component mibiisa. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.

The weakness was presented 08/12/2002 (Website). It is possible to read the advisory at sunsolve.sun.com. The identification of this vulnerability is CVE-2002-0797. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/13/2025). It is expected to see the exploit prices for this product decreasing in the near future.

The vulnerability scanner Nessus provides a plugin with the ID 11335 (Solaris mibiisa MIB Parsing Remote Overflow), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SNMP and running in the context r. The commercial vulnerability scanner Qualys is able to test this issue with plugin 78038 (Sun Solaris mibiisa Remote Buffer Overflow Vulnerability).

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at X-Force (9242), Tenable (11335), SecurityFocus (BID 4933†) and Vulnerability Center (SBV-1212†). See VDB-18682 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Sun

Name

• Solaris

Version

• 2.6
• 7.0
• 8.0

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.oracle.com/sun/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion