CVE-2008-5099

Sun Logical Domain Manager 1.0-1.0.3 - Unauthorized Exposure of OBP Security Password via 'ldm ls -l' Command

Title source: llm
STIX 2.1

Description

Sun Logical Domain Manager (aka LDoms Manager or ldm) 1.0 through 1.0.3 displays the value of the OpenBoot PROM (OBP) security-password variable in cleartext, which allows local users to bypass the SPARC firmware's password protection, and gain privileges or obtain data access, via the "ldm ls -l" command, a different vulnerability than CVE-2008-4992.

References (11)

Core 11
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1021224
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-243606-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32674
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/3154
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32286
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46594

Scores

EPSS 0.0007
EPSS Percentile 20.6%

Details

CWE
CWE-200
Status published
Products (4)
sun/logical_domain_manager 1.0 _nil_
sun/logical_domain_manager 1.0.1 _nil_
sun/logical_domain_manager 1.0.2 _nil_
sun/logical_domain_manager 1.0.3 _nil_
Published Nov 17, 2008
Tracked Since Feb 18, 2026