CVE-2018-2753

Vulnerability in Solaris component (Python modules) of Oracle Sun Systems Products Suite (11.3)

• CVSS 6.0
• CWE-20: Improper Input Validation
• Authentication, Authorization, and Session Management
• Remote

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Python modules). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data as well as unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).

CVE

CVE-2018-2753

CWE

CWE-20: Improper Input Validation

CVSS base score

6.0

Published

2018-04-19

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Solaris to a version that fixes the vulnerability.

import os

def file_access(file_path):
    """Vulnerable function that demonstrates the security issue."""
    if os.path.exists(file_path):
        os.chmod(file_path, 0o666)
        print(f"Permissions set for {file_path}")
    else:
        print(f"File {file_path} does not exist.")

def execute_command(command):
    """Vulnerable function that demonstrates the security issue."""
    os.system(command)

file_access('/path/to/critical/data')
execute_command('ls -l /path/to/critical/data')

import os
import subprocess

BLACKLISTED_COMMANDS = [
    "rm",
    "shutdown",
    "reboot",
    "curl",
    "wget",
    "nc",
    "telnet",
    "bash",
    "python",
    "perl",
]

def is_blacklisted(command):
    """Secure function that fixes the vulnerability."""
    for blacklisted in BLACKLISTED_COMMANDS:
        if blacklisted in command:
            return True
    return False

def file_access(file_path):
    """Secure function that fixes the vulnerability."""
    if os.path.exists(file_path):
        os.chmod(file_path, 0o600)
        print(f"Permissions set for {file_path}")
    else:
        print(f"File {file_path} does not exist.")

def execute_command(command):
    """Secure function that fixes the vulnerability."""
    if is_blacklisted(command[0]):
        print(f"Blocked execution of blacklisted command: {command[0]}")
        return

    try:
        result = subprocess.run(command, check=True, capture_output=True, text=True)
        print("Command executed successfully:", result.stdout)
    except subprocess.CalledProcessError as e:
        print("Error executing command:", e.stderr)

file_access('/path/to/critical/data')
execute_command(['ls', '-l', '/path/to/critical/data'])

@misc{vaitp:cve20182753,
  title        = {{Vulnerability in Solaris component (Python modules) of Oracle Sun Systems Products Suite (11.3)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-2753},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-2753/}}
}