CVE-2006-4439: pkgadd in Sun Solaris 10 before 20060825 installs files with insecure file and directory permissions (755 o...

Security readout for executives and security teams

CVE-2006-4439 is an old Solaris 10 package installation flaw. When pkgadd processed certain package maps, it could install files or directories with overly permissive permissions. A local user could then alter files or directories they should not control, creating integrity and potential privilege-risk concerns on affected Solaris 10 systems. Exposure is most likely in legacy Solaris 10 environments, including appliances or vendor products that depended on affected Solaris packaging behavior. The bundle lists Avaya advisories, so check any Avaya products referencing those notices. No affected CPE list is provided. Prioritize where Solaris 10 remains in production or supports critical business systems. This is not presented as internet-exploitable, but local permission weaknesses on legacy systems can undermine change control and system integrity. Mitigation focus: Inventory Solaris 10 systems and appliances that may include Solaris 10 components.; Review Sun Alert 102513 for the exact vendor patch or update guidance.; Check Avaya ASA-2006-205 and ASA-2006-250 for product-specific exposure..

Prepared

Jun 29, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.