Auth bypass in Oracle Opensolaris

CVE-2009-2282

The Virtual Network Terminal Server daemon (vntsd) for Logical Domains (aka LDoms) in Sun Solaris 10, and OpenSolaris snv_41 through snv_108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown vectors.

Vulnerability class: Broken Access Control

EPSS: 0.004 (31.3th percentile) — read the EPSS interpretation.

Affected products

Oracle Opensolaris
Oracle Solaris — versions 10
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cve@mitre.org (x_refsource_CONFIRM, Patch, Broken Link)
cve@mitre.org (vendor-advisory, Patch, x_refsource_SUNALERT, Broken Link, Vendor Advisory)
cve@mitre.org (x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
cve@mitre.org (x_refsource_OSVDB, vdb-entry, Broken Link)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)