CVE-2020-14871
Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
Description
CVE-2020-14871 is a critical-severity out-of-bounds write vulnerability in Oracle Solaris, specifically in the Pluggable Authentication Module (PAM) component. This vulnerability allows an unauthenticated attacker with network access via multiple protocols to completely compromise Oracle Solaris, with attacks potentially impacting additional products beyond the vulnerable component. The vulnerability affects Oracle Solaris versions 10 and 11 (prior to 11.1) as well as Oracle ZFS Storage Appliance Kit (prior to 8.7). With a maximum CVSS score of 10.0 and an EPSS score of 88.87% (99.5th percentile), CVE-2020-14871 represents one of the most severe Oracle Solaris vulnerabilities. CISA has confirmed active exploitation in the wild through its KEV catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | solaris | >= 10, < 11.1; 9 |
References
- http://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2021/03/03/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2024/07/03/3(Mailing List, Patch)
- https://www.oracle.com/security-alerts/cpuoct2020.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14871(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability where software writes data past the end or before the beginning of the intended buffer. In the case of CVE-2020-14871, a buffer overflow exists in the PAM parse_user_name function of Oracle Solaris, which can be triggered remotely via SunSSH to overwrite adjacent memory and execute arbitrary code with root privileges.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-14871 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL), reflecting the worst possible combination of exploitability and impact. The vulnerability is remotely exploitable over the network without physical access, requires low attack complexity with no special conditions needed, and demands no authentication or user interaction. Scope (Changed): Exploitation of this vulnerability can affect resources beyond the vulnerable Oracle Solaris component, meaning an attacker can pivot to compromise additional systems and services. Confidentiality (High): Full read access to all data on the compromised system, including sensitive credentials, encryption keys, and configuration data. Integrity (High): Complete ability to modify system files, install rootkits, and alter application behavior. Availability (High): Total control over system availability, enabling denial of service or persistent backdoor access. The EPSS score of 88.87% places this vulnerability in the 99.5th percentile, indicating extremely high exploitation activity.
Exploit Maturity
CVE-2020-14871 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available including a Solaris SunSSH remote root exploit via Packet Storm Security, an Oracle Solaris PAM buffer overflow exploit via Packet Storm Security, and another remote root exploit targeting Solaris SunSSH 11.0. The EPSS score of 88.87% indicates extremely high exploitation probability. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Oracle has released patches via the October 2020 Critical Patch Update. Note that Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, are not exploitable.
- Verify that all Oracle Solaris instances are running version 11.1 or later. For Solaris 10 systems, apply the October 2020 CPU patch immediately. Upgrade Oracle ZFS Storage Appliance Kit to version 8.7 or later.
- Restrict SSH access to Oracle Solaris systems using firewall rules and network segmentation. Limit SSH access to trusted administrative networks only and disable SSH access from the internet.
- Monitor SSH authentication logs for anomalous login attempts, especially those involving unusually long usernames that could indicate buffer overflow exploitation attempts. Review system integrity for unauthorized modifications.
- Consider replacing SunSSH with OpenSSH on affected Solaris systems where possible, as the vulnerability is specific to the PAM module's interaction with SunSSH. Implement intrusion detection signatures targeting the PAM parse_user_name buffer overflow pattern.
Technical Details
CVE-2020-14871 affects the Pluggable Authentication Module (PAM) component in Oracle Solaris versions 10 and 11 (prior to 11.1). The vulnerability is a buffer overflow in the parse_user_name function within libpam, which is triggered when processing SSH authentication requests through SunSSH. An attacker can send a specially crafted username that exceeds the expected buffer size, causing an out-of-bounds write that overwrites adjacent stack memory. This allows the attacker to redirect execution flow and achieve arbitrary code execution with root-level privileges. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the maximum possible score, with the Changed scope indicating that exploitation of the PAM module can impact processes and services beyond the SSH daemon itself, enabling full system takeover.
Frequently Asked Questions
Is CVE-2020-14871 being actively exploited?
Yes. CVE-2020-14871 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 88.87% (99.5th percentile) indicates extremely high exploitation probability. No known ransomware campaigns are currently associated with this vulnerability.
What products are affected by CVE-2020-14871?
CVE-2020-14871 affects Oracle Solaris versions 9, 10, and 11 prior to 11.1. Oracle ZFS Storage Appliance Kit versions prior to 8.7 are also affected. Solaris 11.1 and later releases, and ZFSSA 8.7 and later, are not vulnerable to this exploit.
How do I fix CVE-2020-14871?
Apply Oracle's October 2020 Critical Patch Update immediately. Upgrade Oracle Solaris to version 11.1 or later, and Oracle ZFS Storage Appliance Kit to version 8.7 or later. If immediate patching is not possible, restrict SSH access to affected systems from trusted networks only.
How severe is CVE-2020-14871?
CVE-2020-14871 has the maximum CVSS 3.1 score of 10.0 (CRITICAL), indicating the most severe possible vulnerability rating. The Changed scope means exploitation can compromise additional systems beyond the initial target. With an EPSS score in the 99.5th percentile and publicly available root exploits, this vulnerability requires immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.