NVD Vulnerability Detail

CVE-2020-2696

Summary	Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Publication Date	Jan. 16, 2020, 2:15 a.m.
Registration Date	Jan. 26, 2021, 11:56 a.m.
Last Update	Nov. 21, 2024, 2:26 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:10:::::::*

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/155963/SunOS-5.10-Generic_147148-26-Local-Privilege-Escalation.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/155963/SunOS-5.10-Generic_147148-26-Local-Privilege-Escalation.html	Exploit Third Party Advisory VDB Entry
3	http://packetstormsecurity.com/files/155991/Common-Desktop-Environment-2.3.1-Buffer-Overflow.html	Exploit Patch Third Party Advisory VDB Entry
4	http://packetstormsecurity.com/files/155991/Common-Desktop-Environment-2.3.1-Buffer-Overflow.html	Exploit Patch Third Party Advisory VDB Entry
5	http://seclists.org/fulldisclosure/2020/Jan/24	Exploit Mailing List Third Party Advisory
6	http://seclists.org/fulldisclosure/2020/Jan/24	Exploit Mailing List Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2020/01/20/2	Mailing List Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2020/01/20/2	Mailing List Third Party Advisory
9	https://seclists.org/bugtraq/2020/Jan/22	Exploit Mailing List Third Party Advisory
10	https://seclists.org/bugtraq/2020/Jan/22	Exploit Mailing List Third Party Advisory
11	https://www.oracle.com/security-alerts/cpujan2020.html	Patch Vendor Advisory
12	https://www.oracle.com/security-alerts/cpujan2020.html	Patch Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Oracle Systems の Oracle Solaris における Common Desktop Environment に関する脆弱性

Title	Oracle Systems の Oracle Solaris における Common Desktop Environment に関する脆弱性
Summary	Oracle Systems の Oracle Solaris には、Common Desktop Environment に関する処理に不備があるため、機密性、完全性、および可用性に影響のある脆弱性が存在します。
Possible impacts	ローカルユーザにより、情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 14, 2020, midnight
Registration Date	Jan. 30, 2020, 11:27 a.m.
Last Update	Jan. 30, 2020, 11:27 a.m.

Affected System

オラクル

Oracle Solaris 10

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-2696	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2696
National Vulnerability Database (NVD)
2	CVE-2020-2696	https://nvd.nist.gov/vuln/detail/CVE-2020-2696

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-120	https://cwe.mitre.org/data/definitions/120.html

ベンダー情報

No	Name	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - January 2020	https://www.oracle.com/security-alerts/cpujan2020.html
2	Text Form of Oracle Critical Patch Update - January 2020 Risk Matrices	https://www.oracle.com/security-alerts/cpujan2020verbose.html

Change Log

No	Changed Details	Date of change
1	[2020年01月30日] 掲載	Jan. 30, 2020, 11:27 a.m.