#VU17058 Privilege escalation in Oracle Solaris - CVE-2019-2541

Vulnerability identifier: #VU17058

Vulnerability risk: Low

CVSSv4.0: 5.2 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-2541

CWE-ID: CWE-264

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Oracle Solaris
Operating systems & Components / Operating system

Vendor: Oracle

Description
The vulnerability allows an adjacent attacker to gain elevated privileges.

The weakness exists due to unspecified flaw in DHCP Client. An adjacent attacker can gain elevated privileges to conduct further attacks.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Oracle Solaris: 10

---

External links
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixEM

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.