Vulnerability in Sun Solaris

CVE-2004-1394

The pfexec function for Sun Solaris 8 and 9 does not properly handle when a custom profile contains an invalid entry in the exec_attr database, which may allow local users with custom rights profiles to execute profile commands with additional privileges.

EPSS: 0.003 (26.3th percentile) — read the EPSS interpretation.

Affected products

Sun Solaris — versions 9.0
Sun Sunos — versions 5.8
N/a — versions n/a

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (vendor-advisory, Patch, x_refsource_SUNALERT, Vendor Advisory)
cve@mitre.org (x_refsource_AUSCERT, Vendor Advisory, third-party-advisory)
cve@mitre.org (Patch, x_refsource_SECUNIA, third-party-advisory)
cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (x_refsource_OSVDB, vdb-entry)
cve@mitre.org (vdb-entry, x_refsource_BID)