TI-2009-02174 Aliases CVE-2009-2282 GHSA-pgp4-m4pc-4jr6

The Virtual Network Terminal Server daemon (vntsd) for Logical Domains (aka LDoms) in Sun…

LOW 21CWE-862Published 2009-07-01 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The Virtual Network Terminal Server daemon (vntsd) for Logical Domains (aka LDoms) in Sun Solaris 10, and OpenSolaris snv_41 through snv_108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown vectors.

Why it matters now

EPSS 0.00386 32nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:oracle:opensolaris:::::::sparc:*	snv_41 – snv_108	Vulnerable	Oracle
cpe:2.3:o:oracle:solaris:10::::::sparc:	10	Vulnerable	Oracle

cpe:2.3:o:oracle:opensolaris:*:*:*:*:*:*:sparc:* Versions snv_41 – snv_108 Vulnerable ·Oracle
cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:sparc:* Versions 10 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2009-2282
2026-10-03 Alias added: GHSA-pgp4-m4pc-4jr6

References

Patch 2

Other 1

55329

TI-2010-03407 Unspecified vulnerability in Oracle OpenSolaris allows remote attackers to affect… CVSS 2.0HIGH 9.0
TI-2010-00082 Unspecified vulnerability in Oracle OpenSolaris 8, 9, and 10 allows remote attackers to… CVSS 2.0HIGH 7.6
TI-2010-03406 Unspecified vulnerability in Oracle OpenSolaris allows remote attackers to affect… CVSS 2.0MEDIUM 6.4
TI-2010-00843 Unspecified vulnerability in the Solaris component in Oracle Sun Product Suite 10 and… CVSS 2.0HIGH 7.2
TI-2010-03333 Unspecified vulnerability in Oracle Solaris 10 and OpenSolaris allows local users to… CVSS 2.0MEDIUM 6.3
TI-2010-00877 Unspecified vulnerability in Oracle OpenSolaris 10 allows local users to affect… CVSS 2.0MEDIUM 6.2

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences