Sun Solaris configured as Kerberos logs passwords in plain text
| solaris-kerberos-password-plaintext (16450) |  Medium Risk |
Description:
Sun Solaris could allow a local attacker to obtain sensitive information. If the pam_krb5 debug feature is enabled at LOG_DEBUG level, passwords are logged in plain text.
Consequences:
Obtain Information
Remedy:
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert ID: 57587 for more information. See References.
SPARC Platform:
Solaris 9: 112908-16 or later
x86 Platform:
Solaris 9: 115168-04 or later
s a workaround, refer to Sun Alert ID: 57587 for instructions to remove the patches, disable the debug feature of pam_krb5 or disable logging of LOG_DEBUG level messages. See References.
References:
- CIAC Information Bulletin 0-172: Sun Solaris 9 Patches.
- Sun Alert ID: 57587: Solaris 9 Patches 112908-12 and 115168-03 WITHDRAWN, May Cause Passwords to be Logged as Clear Text on Kerberos Clients.
- Sun Alert ID: 57587: Solaris 9 Patches 112908-12 and 115168-03 WITHDRAWN, May Cause Passwords to be Logged as Clear Text on Kerberos Clients.
- BID-10606: Sun Solaris Patches 112908-12 And 115168-03 Clear Text Password Logging Vulnerability
- CVE-2004-0653: Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an auth module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files.
- SA11940: Sun Solaris Kerberos Client Clear Text Password Logging
- US-CERT VU#523710: Sun Solaris patches may cause passwords to be logged in clear text
Platforms Affected:
- Sun Solaris 9 SPARC
Reported:
Jun 18, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net