CVE-2017-3623: Critical severity Oracle Solaris vulnerability
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported versions that are affected see note. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3623 is assigned for "Ebbisland". Solaris 10 systems which have had any Kernel patch installed after, or updated via patching tools since 2012-01-26 are not impacted. Also, any Solaris 10 system installed with Solaris 10 1/13 (Solaris 10 Update 11) are not vulnerable. Solaris 11 is not impacted by this issue. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3623?
CVE-2017-3623 has been classified as an easily exploitable vulnerability with potentially severe impacts.
How do I fix CVE-2017-3623?
To fix CVE-2017-3623, apply the latest security patches provided by Oracle for affected Solaris versions.
Who is affected by CVE-2017-3623?
CVE-2017-3623 affects Oracle Solaris systems that utilize Kernel RPC.
What type of attacks can exploit CVE-2017-3623?
CVE-2017-3623 can be exploited by unauthenticated attackers with network access using multiple protocols.
Is CVE-2017-3623 present in all versions of Solaris?
No, CVE-2017-3623 is present only in specific supported versions of Solaris, not all versions.