PT-2004-1740 · Oracle+1 · Solaris+1

Publicado 2004-07-13 · Atualizado 2017-10-11 · CVE-2004-0653

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Solaris 9 versions with patch 112908-12 or 115168-03

Description The issue allows local users to obtain other users' passwords by reading log files due to the recording of passwords in plaintext when the debug feature is enabled for pam krb5 as an "auth" module.

Recommendations For Solaris 9 with patch 112908-12, disable the debug feature for pam krb5 to prevent password logging. For Solaris 9 with patch 115168-03, disable the debug feature for pam krb5 to prevent password logging.

Correção

Identificadores relacionados

CVE-2004-0653

Produtos afetados

Solaris

Pam Krb5

Referências · 10

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2065 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A255 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101519-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0653 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16450 · Nota
• http://secunia.com/advisories/11940 · Nota
• http://ciac.org/ciac/bulletins/o-172.shtml · Aviso do Fabricante
• http://kb.cert.org/vuls/id/523710 · Correção
• http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57587 · Aviso do Fabricante
• http://securityfocus.com/bid/10606 · Nota