CVE-2017-3632 Other in Solaris Operating System

Critical 9.8 Published 8 Aug 2017 Updated 4 Oct 2024

Unauthenticated remote attackers can compromise Solaris via the CDE Calendar component, leading to full system takeover.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-3632?

CVE-2017-3632 is a critical vulnerability in Oracle Solaris, published on 8 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: CDE Calendar). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3632 is assigned to the "EASYSTREET" vulnerability. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Which versions are affected by CVE-2017-3632?

It affects 1 product.

Products include Oracle Solaris.

How do I fix CVE-2017-3632?

No fix has been published for CVE-2017-3632 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-3632 being exploited?

There is no known exploitation of CVE-2017-3632 in the wild and no public exploit code.

All Oracle Solaris vulnerabilities

Sources

Also known as GHSA-cj83-3cpc-7pmm.