Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-2611: Oracle Sun ZFS Storage Appliance Kit can be taken over

CVE-2018-2611 · published 8 years ago

Summary

Versions of the Oracle Sun ZFS Storage Appliance Kit older than 8.7.13 can be accessed over the network without any credentials, allowing an attacker to take control of the system. This could let the attacker view, change, or delete stored data and disrupt services. Update the appliance to version 8.7.13 or later and restrict network access to trusted users while the update is applied.

What to do

Update oracle sun_zfs_storage_appliance_kit to version 8.7.13 or later.

Affected software

Vendor	Product	Affected versions
oracle	sun_zfs_storage_appliance_kit	< 8.7.13 `cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit::::::::`

Original advisory text

Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services). The supported version that is affected is Prior to 8.7.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

References

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch Vendor Advisory
http://www.securityfocus.com/bid/102587 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040215 Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

10.0 Critical

Exploitation

2% chance of attack within 30 days

Timeline

Published18 Jan 2018

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-2611 · NVD

Track software like this

Free during beta