CVE-2009-4211

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-12-04 · updated 2026-06-16
Weakness: CWE-264

Description

The U.S. Defense Information Systems Agency (DISA) Security Readiness Review (SRR) script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to (1) java, (2) openssl, (3) php, (4) snort, (5) tshark, (6) vncserver, or (7) wireshark, which allows local users to gain privileges via a Trojan horse program.

Affected products

Disa Srr For Solaris: all versions

References

http://securitytracker.com/id?1023265
http://www.kb.cert.org/vuls/id/433821
http://www.securityfocus.com/archive/1/508188/100/0/threaded
http://www.securityfocus.com/bid/37200
http://securitytracker.com/id?1023265
http://www.kb.cert.org/vuls/id/433821
http://www.securityfocus.com/archive/1/508188/100/0/threaded
http://www.securityfocus.com/bid/37200

Get alerted when CVE-2009-4211 or the next vulnerability affects your stack