Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesIn 2020, FireEye tracked a sophisticated intrusion campaign as UNC1945 that exploited CVE-2020-14871, a vulnerability in Oracle Solaris Pluggable Authentication Modules (PAM). Reporting linked the exploit to long usernames passed through SSH Keyboard-Interactive authentication. Oracle addressed the flaw in its October 2020 Critical Patch Update; the incident reporting does not establish who UNC1945 was or prove that it was responsible for a ransomware deployment found at one target.
What was the Solaris zero-day?
CVE-2020-14871 was a stack-based buffer overflow in Solaris PAM. A technical account published by SecurityWeek described the vulnerable parse_user_name function receiving a username longer than PAM_MAX_RESP_SIZE, a 512-byte threshold. In the reported exploit path, SSH Keyboard-Interactive authentication could pass an excessively long username to PAM. Where the SSH path was exposed and the affected configuration applied, the reporting said exploitation could enable compromise without authentication. SecurityWeek’s November 5, 2020 technical coverage explains the reported mechanism.
Oracle addressed the vulnerability in its October 2020 Critical Patch Update. The historical reporting identified some Solaris 9 releases, Solaris 10, Solaris 11.0, and Illumos/OpenIndiana 2020.04 as affected. It said Oracle issued fixes for Solaris 10 and 11 but not Solaris 9, which was no longer supported. It also reported that Solaris 11.1 and later retained the vulnerable function but had PAM changes that truncated usernames before they reached it through SSH. That historical detail does not establish the exposure of every current system or every possible route to the function. Check Oracle’s current advisory and support information for the exact release and configuration in use.
How the reported intrusion unfolded
SecurityWeek’s November 3, 2020 account of FireEye/Mandiant reporting described activity spanning more than two years. In one case, an internet-exposed Solaris system was compromised in late 2018, and the attackers used the SLAPSTICK backdoor to steal credentials. In mid-2020, a different Solaris server was observed connecting to attacker infrastructure after a reported 519-day dwell period. EVILSUN was deployed against a Solaris 9 server. The 519-day figure refers to that reported case, not a typical or population-wide dwell time. SecurityWeek’s November 3, 2020 coverage summarizes the incident reporting.
#1 Best Overall
Who was UNC1945?
UNC1945 is a tracking label used by FireEye/Mandiant for the activity, not a publicly confirmed identity. The reporting described targeting of telecommunications companies and the use of third-party networks to pursue selected financial and professional consulting sectors. Those observations describe the cases reported at the time; they do not identify the people behind the label or establish the full scope of the operation.
What tools and techniques did the reporting describe?
The reported toolkit spanned Solaris, Linux, and Windows. Named tools included the Solaris PAM backdoor SLAPSTICK, the Linux backdoor LEMONSTICK, and EVILSUN, TINYSHELL, OKSOLO, and PUPYRAT. These names provide defensive context; their presence in reporting is not proof that any one tool was used in every intrusion.
The described activity included credential theft, privilege escalation, lateral movement, SSH port forwarding, and persistence. Attackers reportedly used custom QEMU virtual machines preloaded with utilities and manipulated timestamps and logs, techniques consistent with efforts to operate across systems and hinder investigation. The reporting said it did not observe data exfiltration in its cases. It also described a ROLLCOAST ransomware deployment at one target but said UNC1945’s responsibility was unclear; access may have been sold to another actor. The ransomware incident should not be attributed to UNC1945 as a confirmed fact.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should Solaris administrators do?
The incident is historical, but the right response for a live system depends on its exact release, support status, patch level, SSH configuration, and any alternate route to the vulnerable PAM function. Oracle says its Critical Patch Updates provide security patches for supported on-premises products, are usually cumulative, and are available to customers with valid support contracts. Its security-alert index also notes that Oracle does not distribute exploit code. Oracle’s security alerts and patch policy are the appropriate starting point for current guidance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Rank #3
- Identify the exact system. Record the Solaris or Illumos/OpenIndiana release, installed updates, support status, and whether SSH Keyboard-Interactive authentication is enabled and reachable. Do not assume that a release-level statement from 2020 describes a present-day deployment.
- Check current Oracle guidance. Consult the applicable Oracle advisory and support materials to determine whether a fix exists and applies to the system. Oracle’s patch calendar and product support status can change.
- Apply the supported fix where available. The historical reporting identified Oracle fixes for Solaris 10 and 11 in the October 2020 update. For an operational system, verify the exact current patch applicability with Oracle rather than relying on that historical summary.
- If patching is not immediately possible, assess exposure with qualified administrators. The 2020 technical account described disabling SSH Challenge-Response/Keyboard-Interactive authentication in
/etc/ssh/sshd_configand restarting SSH as a workaround. It warned that this does not remove the underlying vulnerability or rule out other routes to the vulnerable function. Confirm service impact and a safe recovery path before changing SSH settings. - Investigate suspected compromise. Because the reporting described long dwell time, credential theft, log and timestamp manipulation, and lateral movement, suspected exposure warrants a broader review than checking for one named malware file. Preserve relevant evidence and involve qualified incident-response staff when production systems or credentials may be affected.
What the reporting does—and does not—establish
- It documents a reported Solaris PAM zero-day exploit path and specific intrusion cases, not a population-level measure of how often Solaris systems were compromised.
- It identifies UNC1945 as a FireEye/Mandiant tracking label, not a verified public identity.
- It reports no observed data exfiltration in the cases described; that is not proof that data was never taken in other activity.
- It describes ransomware at one target but leaves responsibility unresolved, so a direct UNC1945 attribution is not established.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
