CVE-2000-0069: Low severity Sun Solstice Backup vulnerability
The recover program in Solstice Backup allows local users to restore sensitive files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Sun Solstice Backup (recover program)from your environment.If recover functionality is not required, uninstall or disable the recover utility or the Solstice Backup component that provides it to eliminate the ability for local users to restore sensitive files.
- Configuration
Change ownership and filesystem permissions or other local access control so the recover executable and any restore utilities can only be executed by administrative/trusted accounts (e.g., restrict group membership and set mode to prevent execution by unprivileged users).
Sun Solstice Backup (recover program) executable permissions / access control = restricted to administrative/trusted accounts only - Compensating control
Restrict local access to systems hosting Solstice Backup: remove or disable untrusted local accounts, enforce least-privilege access, and limit administrative console/SSH access to trusted administrators only.
- Operational
Review audit and system logs for past uses of the recover program to detect unauthorized restores; investigate any exposures and remediate by restoring correct file permissions and access, and take further actions as appropriate (e.g., revoke access for implicated accounts).
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0069?
CVE-2000-0069 is considered to have a medium severity rating due to its potential to expose sensitive files to local users.
How do I fix CVE-2000-0069?
To fix CVE-2000-0069, ensure that access controls are properly configured to restrict the use of the recover program to authorized users only.
What are the potential impacts of CVE-2000-0069?
If exploited, CVE-2000-0069 can lead to unauthorized access to sensitive files by local users.
Which version of Solstice Backup is affected by CVE-2000-0069?
CVE-2000-0069 specifically affects version 5.1 of Sun Solstice Backup.
Is CVE-2000-0069 a local or remote vulnerability?
CVE-2000-0069 is classified as a local vulnerability since it requires local user access to exploit.