Information disclosure in Sun Solaris
CVE-2005-3398
The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers.
Vulnerability class: Information Disclosure
EPSS: 0.131 (96.0th percentile) — read the EPSS interpretation.
Affected products
- Sun Solaris — versions 9.0, 10.0
- Sun Sunos — versions 5.8
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (vendor-advisory, Patch, x_refsource_SUNALERT, Vendor Advisory)
- cve@mitre.org (x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (Patch, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2005-3398?
- CVE-2005-3398 is a vulnerability in Sun Solaris, classified under Information Disclosure. Published 2005-11-01.
- Is CVE-2005-3398 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.