Sun CVEs — known vulnerabilities

Sparc Enterprise Server HIGH 10.0

CVE-2009-0171

The Sun SPARC Enterprise M4000 and M5000 Server, within a certain range of serial numbers, allows remote attackers to use the manufacturing root pass…

Mitigation only

Fix from $1,950 2009-01-16

Java System Access Manager HIGH 9.0

CVE-2009-0169

Sun Java System Access Manager 7.1 allows remote authenticated sub-realm administrators to gain privileges, as demonstrated by creating the amadmin a…

Patch available

Fix from $1,950 2009-01-16

Opensolaris HIGH 7.2

CVE-2008-5908

Unspecified vulnerability in the root/boot archive tool in Sun OpenSolaris has unknown impact and local attack vectors, related to a "Temporary file …

Mitigation only

Fix from $1,950 2009-01-16

Opensolaris HIGH 7.2

CVE-2008-5909

Unspecified vulnerability in conv_lpd in Sun OpenSolaris has unknown impact and local attack vectors, related to improper handling of temporary files…

Mitigation only

Fix from $1,950 2009-01-16

Opensolaris HIGH 7.2

CVE-2008-5910

Unspecified vulnerability in txzonemgr in Sun OpenSolaris has unknown impact and local attack vectors, related to a "Temporary file vulnerability," a…

Mitigation only

Fix from $1,950 2009-01-16

Java System Access Manager MEDIUM 6.0

CVE-2009-0170

Sun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users with console privileges to discover passwords, and obt…

Patch available

Fix from $1,600 2009-01-16

Grid Engine MEDIUM 5.0

CVE-2009-0046

Sun GridEngine 5.3 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to b…

Fix: after 5.3

Fix from $1,600 2009-01-07

Snmp Management Agent MEDIUM 6.9

CVE-2008-5746

Sun SNMP Management Agent (SUNWmasf) 1.4u2 through 1.5.4 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on …

Mitigation only

Fix from $1,600 2008-12-29

Scapp HIGH 10.0

CVE-2008-5685

Sun ScApp firmware 5.18.x, 5.19.x, and 5.20.0 through 5.20.10 on Sun Fire and Netra platforms allows remote attackers to access the System Controller…

Patch available

Fix from $1,950 2008-12-19

Opensolaris HIGH 7.2

CVE-2008-5689

tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (panic) and possibly execute arb…

Patch available

Fix from $1,950 2008-12-19

Opensolaris MEDIUM 5.0

CVE-2008-5684

Unspecified vulnerability in the X Inter Client Exchange library (aka libICE) in Sun Solaris 8 through 10 and OpenSolaris before snv_85 allows contex…

Patch available

Fix from $1,600 2008-12-19

Java Wireless Toolkit For Cldc HIGH 9.3

CVE-2008-5662

Multiple buffer overflows in Sun Java Wireless Toolkit (WTK) for CLDC 2.5.2 and earlier allow downloaded programs to execute arbitrary code via unkno…

Fix: after 2.5.2

Fix from $1,950 2008-12-17

Opensolaris MEDIUM 5.4

CVE-2008-5661

The IPv4 Forwarding feature in Sun Solaris 10 and OpenSolaris snv_47 through snv_82, with certain patches installed, allows remote attackers to cause…

Patch available

Fix from $1,600 2008-12-17

Java System Portal Server MEDIUM 5.0

CVE-2008-5549

Unspecified vulnerability in the Sun Java Web Console components in Sun Java System Portal Server 7.1 and 7.2 allows remote attackers to access local…

Patch available

Fix from $1,600 2008-12-12

Ray Server Software HIGH 7.5

CVE-2008-5422

Sun Sun Ray Server Software 3.1 through 4.0 does not properly restrict access, which allows remote attackers to discover the Sun Ray administration p…

Patch available

Fix from $1,950 2008-12-11

Solaris HIGH 7.8

CVE-2008-5410

The PK11_SESSION cache in the OpenSSL PKCS#11 engine in Sun Solaris 10 does not maintain reference counts for operations with asymmetric keys, which …

Patch available

Fix from $1,950 2008-12-10

Jdk HIGH 10.0

CVE-2008-5340

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlie…

Fix: after 6