OSVDB ID: 6437 Title: Sun Cluster in.mond Arbitrary File Access |
Info |
|
|
Dates |
||||
|
|
Description |
Sun Cluster contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a user removes the status file, creates a symlink in the /var/opt/SUNWcluster/fm/fmstatus/nfs/<logicalhostname> directory, then telnets into localhost on port 1200 which will disclose all files on the system resulting in a loss of confidentiality. |
Classification |
Location:
Local Access Required
Attack Type: Information Disclosure, Misconfiguration, Race Condition Impact: Loss of Confidentiality Exploit: Exploit Public |
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, Sun has released a patch to address this vulnerability. |
Products |
|
References |
|
Credit |
|
firest0rm.org -