CVE-2007-2617 Information disclosure in n/a
Local users can read the first line of arbitrary files in Sun Solaris 10 due to missing file permission checks in srsexec.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-2617?
CVE-2007-2617 is a low-severity vulnerability in n/a, published on 11 May 2007. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options.
Which versions are affected by CVE-2007-2617?
It affects 1 product.
Products include Sun Net Connect Software.
How do I fix CVE-2007-2617?
No fix has been published for CVE-2007-2617 yet. Limit exposure of the affected software until one is available.
Is CVE-2007-2617 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-2617 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j62r-gh7r-3r6w.