NVD Vulnerability Detail

CVE-2010-4435

Summary	Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows remote attackers to affect confidentiality, integrity, and availability, related to CDE Calendar Manager Service Daemon and RPC. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from other software vendors that this affects other operating systems, such as HP-UX, or claims from a reliable third party that this is a buffer overflow in rpc.cmsd via long XDR-encoded ASCII strings in RPC call 10.
Publication Date	Jan. 20, 2011, 2 a.m.
Registration Date	Jan. 29, 2021, 11:09 a.m.
Last Update	Nov. 21, 2024, 10:20 a.m.

CVSS2.0 : HIGH
Score	10.0
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:sun:sunos:5.8:::::::*
cpe:2.3:o:sun:sunos:5.10:::::::*
cpe:2.3:o:sun:sunos:5.9:::::::*

Related information, measures and tools

No	URL	タグ
1	http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc
2	http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc
3	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02702395
4	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02702395
5	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02702395
6	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02702395
7	http://osvdb.org/70569
8	http://osvdb.org/70569
9	http://secunia.com/advisories/42984	Vendor Advisory
10	http://secunia.com/advisories/42984	Vendor Advisory
11	http://secunia.com/advisories/43258	Vendor Advisory
12	http://secunia.com/advisories/43258	Vendor Advisory
13	http://securityreason.com/securityalert/8069
14	http://securityreason.com/securityalert/8069
15	http://www.exploit-db.com/exploits/16137	Exploit
16	http://www.exploit-db.com/exploits/16137	Exploit
17	http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html	Vendor Advisory
18	http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html	Vendor Advisory
19	http://www.securityfocus.com/archive/1/516284/100/0/threaded
20	http://www.securityfocus.com/archive/1/516284/100/0/threaded
21	http://www.securityfocus.com/archive/1/516304/100/0/threaded
22	http://www.securityfocus.com/archive/1/516304/100/0/threaded
23	http://www.securityfocus.com/bid/45853
24	http://www.securityfocus.com/bid/45853
25	http://www.securityfocus.com/bid/46261
26	http://www.securityfocus.com/bid/46261
27	http://www.securitytracker.com/id?1024975
28	http://www.securitytracker.com/id?1024975
29	http://www.vupen.com/english/advisories/2011/0151	Vendor Advisory
30	http://www.vupen.com/english/advisories/2011/0151	Vendor Advisory
31	http://www.vupen.com/english/advisories/2011/0352	Vendor Advisory
32	http://www.vupen.com/english/advisories/2011/0352	Vendor Advisory
33	http://www.zerodayinitiative.com/advisories/ZDI-11-062/
34	http://www.zerodayinitiative.com/advisories/ZDI-11-062/
35	https://exchange.xforce.ibmcloud.com/vulnerabilities/64797
36	https://exchange.xforce.ibmcloud.com/vulnerabilities/64797
37	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12794
38	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12794

Common Vulnerabilities List

JVN Vulnerability Information

Oracle Solaris の CDE Calendar Manager Service Daemon および RPC における脆弱性

Title	Oracle Solaris の CDE Calendar Manager Service Daemon および RPC における脆弱性
Summary	Oracle Solaris には、CDE Calendar Manager Service Daemon および RPC に関する処理に不備があるため、機密性、完全性、可用性に影響のある脆弱性が存在します。
Possible impacts	第三者により、情報が漏えいする、あるいは情報を改ざんされたり、サービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 18, 2011, midnight
Registration Date	Feb. 16, 2011, 2:07 p.m.
Last Update	Feb. 16, 2011, 2:07 p.m.

Affected System

ヒューレット・パッカード

HP-UX 11.23

HP-UX 11.31

オラクル

Oracle Solaris 10

Oracle Solaris 8

Oracle Solaris 9

IBM

IBM AIX 5.3 およびそれ以前

IBM AIX 6.1 およびそれ以前

IBM VIOS 1.4 およびそれ以前

IBM VIOS 1.5 およびそれ以前

IBM VIOS 2.1 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-4435	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4435
National Vulnerability Database (NVD)
2	CVE-2010-4435	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4435

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
HP Security Bulletin
1	HPSBUX02628	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02702395
IBM Support Document
2	5212	http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=5212
Oracle Critical Patch Update
3	cpujan2011-194091	http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

その他

No	Name	URL
ISS X-Force Database
1	64797	http://xforce.iss.net/xforce/xfdb/64797
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
2	70569	http://osvdb.org/70569
Secunia Advisory
3	SA42984	http://secunia.com/advisories/42984
4	SA43258	http://secunia.com/advisories/43258
SecurityFocus
5	45853	http://www.securityfocus.com/bid/45853
6	46261	http://www.securityfocus.com/bid/46261
SecurityTracker
7	1024975	http://www.securitytracker.com/id?1024975
VUPEN Security
8	VUPEN/ADV-2011-0151	http://www.vupen.com/english/advisories/2011/0151
9	VUPEN/ADV-2011-0352	http://www.vupen.com/english/advisories/2011/0352

Change Log

No	Changed Details	Date of change
0	[2011年02月16日] 掲載	Feb. 17, 2018, 10:37 a.m.