CVE-2017-3623
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported versions that are affected see note. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3623 is assigned for "Ebbisland". Solaris 10 systems which have had any Kernel patch installed after, or updated via patching tools since 2012-01-26 are not impacted. Also, any Solaris 10 system installed with Solaris 10 1/13 (Solaris 10 Update 11) are not vulnerable. Solaris 11 is not impacted by this issue. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Key facts
- CVSS score
- 10.0 (v3.0)
- Severity
- CRITICAL
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- EPSS score
- 22.5% (98th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2017-12740)
- Published
- April 24, 2017
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2017-12740 in the EU Vulnerability Database. Last updated in EUVD on October 4, 2024.
View on the EU Vulnerability DatabaseAffected products
- oracle / solaris
Certified products that may be affected
15 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Oracle VM Server for SPARC 3.6 and Oracle Solaris 11.4 - Oracle Corporation - Common Criteria 614-LSS - active
- Oracle Solaris Userland Cryptographic Framework - Oracle Corporation - FIPS 140 4142 - historical
- Oracle Solaris Kernel Cryptographic Framework - Oracle Corporation - FIPS 140 4034 - historical
- Oracle Solaris 11.4 - Oracle Corporation - Common Criteria 503-LSS - archived
- Oracle Solaris Kernel Cryptographic Framework - Oracle Corporation - FIPS 140 2698 - historical
See all 15 in the Security Certifications Explorer.
References
- http://packetstormsecurity.com/files/155876/EBBISLAND-EBBSHAVE-6100-09-04-1441-Remote-Buffer-Overflow.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/97778(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038292
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain