CVE-2008-5099

Sun Logical Domain Manager (aka LDoms Manager or ldm) 1.0 through 1.0.3 displays the value of the OpenBoot PROM (OBP) security-password variable in cleartext, which allows local users to bypass the SPARC firmware's password protection, and gain privileges or obtain data access, via the "ldm ls -l" command, a different vulnerability than CVE-2008-4992.

• CWE-200

• http://secunia.com/advisories/32674Vendor Advisory
• http://securitytracker.com/id?1021224
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139395-02-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139396-02-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139397-02-1Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139398-01-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-243606-1Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2008-460.htm
• http://www.securityfocus.com/bid/32286
• http://www.vupen.com/english/advisories/2008/3154
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46594
• http://secunia.com/advisories/32674Vendor Advisory
• http://securitytracker.com/id?1021224
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139395-02-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139396-02-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139397-02-1Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139398-01-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-243606-1Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2008-460.htm
• http://www.securityfocus.com/bid/32286
• http://www.vupen.com/english/advisories/2008/3154
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46594

Published

Nov 17, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-5093Cross-site scripting (XSS) vulnerability in the HTTP Protoco…
• CVE-2008-5094Heap-based buffer overflow in the NDS Service in Novell eDir…
• CVE-2008-5095Cross-site scripting (XSS) vulnerability in the Novell User …
• CVE-2008-5096Unspecified vulnerability in the TYPO3 File List (file_list)…
• CVE-2008-5097SQL injection vulnerability in index.php in MyFWB 1.0 allows…
• CVE-2008-5098Cross-site scripting (XSS) vulnerability in Sun Java System …
• CVE-2008-5100The strong name (SN) implementation in Microsoft .NET Framew…
• CVE-2008-5101Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 a…
• CVE-2008-5102PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga…
• CVE-2008-5103The (1) python-vm-builder and (2) ubuntu-vm-builder implemen…
• CVE-2008-5104Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as…
• CVE-2008-5105KarjaSoft Sami FTP Server 2.0.x allows remote attackers to c…