CVE-2007-2617
First published: Fri May 11 2007(Updated: )
srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Solaris and Zettabyte File System (ZFS) | =10.0 | |
| Sun Net Connect Software | =3.2.3 | |
| Sun Net Connect Software | =3.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=531
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102891-1
- http://www.securityfocus.com/bid/23915
- http://secunia.com/advisories/25194
- http://www.securitytracker.com/id?1018046
- http://osvdb.org/35940
- http://www.vupen.com/english/advisories/2007/1769
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34223
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1920
Frequently Asked Questions
What is the severity of CVE-2007-2617?
CVE-2007-2617 is classified as a moderate severity vulnerability due to its potential impact on local user access to sensitive file data.
How do I fix CVE-2007-2617?
To mitigate CVE-2007-2617, ensure that you upgrade to the latest patched version of the Sun Remote Services Net Connect Software.
Who is affected by CVE-2007-2617?
CVE-2007-2617 affects users of Sun Remote Services Net Connect Software versions 3.2.3 and 3.2.4 running on Solaris 10.
What type of vulnerability is CVE-2007-2617?
CVE-2007-2617 is a local file permission vulnerability that allows unauthorized access to read the first line of arbitrary files.
Can CVE-2007-2617 be exploited remotely?
CVE-2007-2617 cannot be exploited remotely; it requires local access to the affected system to execute the exploit.
- collector/nvd-historical
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sun
- canonical/oracle solaris and zettabyte file system (zfs)
- version/oracle solaris and zettabyte file system (zfs)/10.0
- canonical/sun net connect software
- version/sun net connect software/3.2.3
- version/sun net connect software/3.2.4