vulnwire
7.2high

CVE-2004-26861 exploit

Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modu…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
1
Exploit-DB

Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure.

Exploit prediction (EPSS)

1.17% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.

Exploits and detections

  • EDB-23874 Sun Solaris 2.6/7.0/8/9 - vfs_getvfssw function Privilege Escalation · local · 2004-03-23

CVSS scores

Assigned byVersionScoreVector
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • securityfocus.com /bid/9962 · vdb-entry, x_refsource_BID, x_transferred
  • seclists.org /bugtraq/2004/Apr/0081.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • derkeiler.com /Mailing-Lists/Full-Disclosure/2004-04/0297.html · mailing-list, x_refsource_FULLDISC, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1381 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • immunitysec.com /downloads/solaris_kernel_vfs.sxw.pdf · x_refsource_MISC, x_transferred
  • securitytracker.com /id?1008833 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.