PT-2004-1740 · Oracle+1 · Solaris+1

Published 2004-07-13 · Updated 2017-10-11 · CVE-2004-0653

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Solaris 9 versions with patch 112908-12 or 115168-03

Description The issue allows local users to obtain other users' passwords by reading log files due to the recording of passwords in plaintext when the debug feature is enabled for pam krb5 as an "auth" module.

Recommendations For Solaris 9 with patch 112908-12, disable the debug feature for pam krb5 to prevent password logging. For Solaris 9 with patch 115168-03, disable the debug feature for pam krb5 to prevent password logging.

Fix

Related Identifiers

CVE-2004-0653

Affected Products

Solaris

Pam Krb5

References · 10

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101519-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0653 · Security Note
• http://ciac.org/ciac/bulletins/o-172.shtml · Vendor Advisory
• http://kb.cert.org/vuls/id/523710 · Patch
• http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57587 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2065 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A255 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16450 · Note
• http://secunia.com/advisories/11940 · Note
• http://securityfocus.com/bid/10606 · Note