Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-3270: Oracle Solaris 11.3 may allow partial shutdown by a local user

CVE-2018-3270 · published 8 years ago

Summary

The Solaris 11.3 operating system could let a user who already has a high‑level login cause part of the system to stop working. The attack requires the user to be on the same machine and to interact with it, so it is not remote. Install the latest security updates from Oracle and restrict high‑privilege access to trusted administrators only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	solaris	11.3 `cpe:2.3:o:oracle:solaris:11.3:::::::*`

Original advisory text

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 1.8 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L).

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch Vendor Advisory
http://www.securityfocus.com/bid/105605 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041895 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

1.8 Low

Exploitation

<1% chance of attack within 30 days

Timeline

Published17 Oct 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-3270 · NVD

Track software like this

Free during beta