tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request, which triggers a NULL pointer dereference.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Opensolaris | Sun | snv_01 (including) | snv_01 (including) |
| Opensolaris | Sun | snv_02 (including) | snv_02 (including) |
| Opensolaris | Sun | snv_03 (including) | snv_03 (including) |
| Opensolaris | Sun | snv_04 (including) | snv_04 (including) |
| Opensolaris | Sun | snv_05 (including) | snv_05 (including) |
| Opensolaris | Sun | snv_06 (including) | snv_06 (including) |
| Opensolaris | Sun | snv_07 (including) | snv_07 (including) |
| Opensolaris | Sun | snv_08 (including) | snv_08 (including) |
| Opensolaris | Sun | snv_09 (including) | snv_09 (including) |
| Opensolaris | Sun | snv_10 (including) | snv_10 (including) |
| Opensolaris | Sun | snv_11 (including) | snv_11 (including) |
| Opensolaris | Sun | snv_12 (including) | snv_12 (including) |
| Opensolaris | Sun | snv_13 (including) | snv_13 (including) |
| Opensolaris | Sun | snv_14 (including) | snv_14 (including) |
| Opensolaris | Sun | snv_15 (including) | snv_15 (including) |
| Opensolaris | Sun | snv_16 (including) | snv_16 (including) |
| Opensolaris | Sun | snv_17 (including) | snv_17 (including) |
| Opensolaris | Sun | snv_18 (including) | snv_18 (including) |
| Opensolaris | Sun | snv_19 (including) | snv_19 (including) |
| Opensolaris | Sun | snv_20 (including) | snv_20 (including) |
| Opensolaris | Sun | snv_21 (including) | snv_21 (including) |
| Opensolaris | Sun | snv_22 (including) | snv_22 (including) |
| Opensolaris | Sun | snv_23 (including) | snv_23 (including) |
| Opensolaris | Sun | snv_24 (including) | snv_24 (including) |
| Opensolaris | Sun | snv_25 (including) | snv_25 (including) |
| Opensolaris | Sun | snv_26 (including) | snv_26 (including) |
| Opensolaris | Sun | snv_27 (including) | snv_27 (including) |
| Opensolaris | Sun | snv_28 (including) | snv_28 (including) |
| Opensolaris | Sun | snv_29 (including) | snv_29 (including) |
| Opensolaris | Sun | snv_30 (including) | snv_30 (including) |
| Opensolaris | Sun | snv_31 (including) | snv_31 (including) |
| Opensolaris | Sun | snv_32 (including) | snv_32 (including) |
| Opensolaris | Sun | snv_33 (including) | snv_33 (including) |
| Opensolaris | Sun | snv_34 (including) | snv_34 (including) |
| Opensolaris | Sun | snv_35 (including) | snv_35 (including) |
| Opensolaris | Sun | snv_36 (including) | snv_36 (including) |
| Opensolaris | Sun | snv_37 (including) | snv_37 (including) |
| Opensolaris | Sun | snv_38 (including) | snv_38 (including) |
| Opensolaris | Sun | snv_39 (including) | snv_39 (including) |
| Opensolaris | Sun | snv_40 (including) | snv_40 (including) |
| Opensolaris | Sun | snv_41 (including) | snv_41 (including) |
| Opensolaris | Sun | snv_42 (including) | snv_42 (including) |
| Opensolaris | Sun | snv_43 (including) | snv_43 (including) |
| Opensolaris | Sun | snv_44 (including) | snv_44 (including) |
| Opensolaris | Sun | snv_45 (including) | snv_45 (including) |
| Opensolaris | Sun | snv_46 (including) | snv_46 (including) |
| Opensolaris | Sun | snv_47 (including) | snv_47 (including) |
| Opensolaris | Sun | snv_48 (including) | snv_48 (including) |
| Opensolaris | Sun | snv_49 (including) | snv_49 (including) |
| Opensolaris | Sun | snv_50 (including) | snv_50 (including) |
| Opensolaris | Sun | snv_51 (including) | snv_51 (including) |
| Opensolaris | Sun | snv_52 (including) | snv_52 (including) |
| Opensolaris | Sun | snv_53 (including) | snv_53 (including) |
| Opensolaris | Sun | snv_54 (including) | snv_54 (including) |
| Opensolaris | Sun | snv_55 (including) | snv_55 (including) |
| Opensolaris | Sun | snv_56 (including) | snv_56 (including) |
| Opensolaris | Sun | snv_57 (including) | snv_57 (including) |
| Opensolaris | Sun | snv_58 (including) | snv_58 (including) |
| Opensolaris | Sun | snv_59 (including) | snv_59 (including) |
| Opensolaris | Sun | snv_60 (including) | snv_60 (including) |
| Opensolaris | Sun | snv_61 (including) | snv_61 (including) |
| Opensolaris | Sun | snv_62 (including) | snv_62 (including) |
| Opensolaris | Sun | snv_63 (including) | snv_63 (including) |
| Opensolaris | Sun | snv_64 (including) | snv_64 (including) |
| Opensolaris | Sun | snv_65 (including) | snv_65 (including) |
| Opensolaris | Sun | snv_66 (including) | snv_66 (including) |
| Opensolaris | Sun | snv_67 (including) | snv_67 (including) |
| Opensolaris | Sun | snv_68 (including) | snv_68 (including) |
| Opensolaris | Sun | snv_69 (including) | snv_69 (including) |
| Opensolaris | Sun | snv_70 (including) | snv_70 (including) |
| Opensolaris | Sun | snv_71 (including) | snv_71 (including) |
| Opensolaris | Sun | snv_72 (including) | snv_72 (including) |
| Opensolaris | Sun | snv_73 (including) | snv_73 (including) |
| Opensolaris | Sun | snv_74 (including) | snv_74 (including) |
| Opensolaris | Sun | snv_75 (including) | snv_75 (including) |
| Opensolaris | Sun | snv_76 (including) | snv_76 (including) |
| Opensolaris | Sun | snv_100 (including) | snv_100 (including) |
| Opensolaris | Sun | snv_101 (including) | snv_101 (including) |
| Opensolaris | Sun | snv_102 (including) | snv_102 (including) |
| Solaris | Sun | 10.0 (including) | 10.0 (including) |