SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   Sun Integrated Lights-Out Manager Vendors:   Oracle, Sun
Sun Integrated Lights-Out Manager Bugs Let Remote Authenticated Users Partially Access Data, Modify Data, and Deny Service
SecurityTracker Alert ID:  1031594
SecurityTracker URL:  http://securitytracker.com/id/1031594
CVE Reference:   CVE-2013-6450, CVE-2014-0224, CVE-2014-6584, CVE-2015-0424   (Links to External Site)
Date:  Jan 21 2015
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 3.2.4
Description:   Several vulnerabilities were reported in Sun Integrated Lights-Out Manager. A remote authenticated user can cause partial denial of service conditions. A remote authenticated user can partially access and modify data.

A remote authenticated user can exploit a flaw in the Integrated Lights Out Manager (ILOM) IPMI component to partially access data, partially modify data, and deny service [CVE-2015-0424].

A remote authenticated user can exploit a flaw in the ILOM Backup Restore component to partially access data [CVE-2014-6584].

A remote authenticated user can exploit a flaw in the ILOM OpenSSL component to partially access and partially modify data [CVE-2014-0224].

A remote authenticated user can exploit a flaw in the ILOM OpenSSL component to cause partial denial of service conditions [CVE-2013-6450].

The following researchers reported these and other Oracle vulnerabilities:

Abdullah Erdem; Adam Willard of Foreground Security; Amir Sohail; Arjun V; Avik Sarkar; Ayoub Nait Lamine; Ben Khlifa Fahmi; Cameron Crowley; Christian Galeone;
Gaurav Mishra; Gopal Bisht; Gurjant Singh Sadhra; Karthik E C; Koutrouss Naddara; M.Asim Shahzad; Mohammed Osman; Monendra Sahu; Mousab Elhag; Muhammad Sarmad Shafiq; Rakesh Singh of Zero Day Guys; Sandeep Venkatesan; Sky_BlaCk; Sreehari; Srikanth Y; and Yann CAM.

Impact:   A remote authenticated user can cause partial denial of service conditions.

A remote authenticated user can partially access and modify data.

Solution:   The vendor has issued a fix as part of the Oracle Critical Patch Update Advisory - January 2015.

The vendor's advisory is available at:

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Vendor URL:  www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html (Links to External Site)
Cause:   Not specified
Underlying OS:  UNIX (Solaris - SunOS)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, SecurityGlobal.net LLC