Information disclosure in Sun Solaris
CVE-2005-3398
The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.131 (96.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.131 · newest: 0.131 · change: 0.000
Affected products
- Sun Solaris — versions 9.0, 10.0
- Sun Sunos — versions 5.8
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/15222 (vdb-entry)
- secunia.com/advisories/17334 (third-party-advisory)
- sunsolve.sun.com/search/document.do (vendor-advisory, Patch, Vendor Advisory)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:1445 (signature, vdb-entry)
- www.vupen.com/english/advisories/2005/2226 (vdb-entry)
- securitytracker.com/id (Patch, vdb-entry)
Frequently asked questions
- What is CVE-2005-3398?
- CVE-2005-3398 is a vulnerability in Sun Solaris, classified under Information Disclosure. Published 2005-11-01.
- Is CVE-2005-3398 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.