CVE-2007-6505 Security feature bypass in n/a
Attackers can evade audit detection by generating records with ID 0 during SSH login on Solaris 9 with specific patches and auditing enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-6505?
CVE-2007-6505 is a low-severity vulnerability in Sun Solaris, published on 20 Dec 2007. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even when the user logging into ssh is not root, which makes it easier for attackers to avoid detection and can make it more difficult to conduct forensics activities.
Weakness: CWE-16
Which versions are affected by CVE-2007-6505?
It affects 1 product.
Products include Sun Solaris.
How do I fix CVE-2007-6505?
No fix has been published for CVE-2007-6505 yet. Limit exposure of the affected software until one is available.
Is CVE-2007-6505 being exploited?
There is no known exploitation of CVE-2007-6505 in the wild and no public exploit code.
Other vulnerabilities in Sun Solaris
Sources
Also known as GHSA-gghp-cf4v-c825.