The NFS daemon (aka nfsd) in Sun Solaris 10 and OpenSolaris before snv_106, when NFSv3 is used, does not properly implement combinations of security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the sec=sys and sec=krb5 security modes, related to modes that "override each other."
                
            References
                    Configurations
                    Configuration 1 (hide)
| 
 | 
Configuration 2 (hide)
| 
 | 
History
                    21 Nov 2024, 01:01
| Type | Values Removed | Values Added | 
|---|---|---|
| References | () http://osvdb.org/52560 - | |
| References | () http://secunia.com/advisories/34225 - Vendor Advisory | |
| References | () http://secunia.com/advisories/34435 - | |
| References | () http://securitytracker.com/id?1021832 - Exploit | |
| References | () http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1 - Patch, Vendor Advisory | |
| References | () http://sunsolve.sun.com/search/document.do?assetkey=1-66-250306-1 - Patch, Vendor Advisory | |
| References | () http://support.avaya.com/elmodocs2/security/ASA-2009-096.htm - | |
| References | () http://www.securityfocus.com/bid/34062 - Exploit | |
| References | () http://www.vupen.com/english/advisories/2009/0657 - Vendor Advisory | |
| References | () http://www.vupen.com/english/advisories/2009/0814 - | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/49171 - | 
Information
                Published : 2009-03-11 14:19
Updated : 2025-04-09 00:30
NVD link : CVE-2009-0873
Mitre link : CVE-2009-0873
CVE.ORG link : CVE-2009-0873
JSON object : View
Products Affected
                sun
- solaris
- opensolaris
- sunos
CWE
                
                    
                        
                        CWE-264
                        
            Permissions, Privileges, and Access Controls
