SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Kerberos Vendors:   Sun
Sun Kerberos Security Patch May Disclose Kerberos Client Passwords to Local Users
SecurityTracker Alert ID:  1010530
SecurityTracker URL:  http://securitytracker.com/id/1010530
CVE Reference:   CVE-2004-0653   (Links to External Site)
Updated:  Jul 14 2004
Original Entry Date:  Jun 18 2004
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in a Sun security patch for Kerberos. A local user may be able to view a user's password in certain cases.

Sun reported that on a Solaris 9 system configured as a kerberos client with patch 112908-12 or 115168-03 installed and any service using pam_krb5 as an "auth" module, the user's password will be logged in clear text when the pam_krb5 debug feature is enabled at LOG_DEBUG level.

Patches 112908-12 and 115168-03 have been WITHDRAWN and are no longer available on SunSolve.

Solaris 7 and 8 are not affected by this issue.

Impact:   The target user's password may be written to a log file in plaintext.
Solution:   Sun has issued the following fixes:

SPARC Platform

* Solaris 9 with patch 112908-13 or later

x86 Platform

* Solaris 9 with patch 115168-04 or later

Vendor URL:  sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57587 (Links to External Site)
Cause:   Access control error
Underlying OS:  UNIX (Solaris - SunOS)
Underlying OS Comments:  9

Message History:   None.


 Source Message Contents

Subject:  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57587


http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57587

57587 	  	Solaris 9 Patches 112908-12 and 115168-03 WITHDRAWN, May Cause Passwords to be 
Logged as Clear Text on Kerberos Clients 	  	17 Jun 2004

Sun reports that on a Solaris 9 system configured as a kerberos client with patch 
112908-12 or 115168-03 installed and any service using pam_krb5 as an "auth" module, the 
user's password will be logged in clear text when the pam_krb5 debug feature is enabled at 
LOG_DEBUG level.

Patches 112908-12 and 115168-03 have been WITHDRAWN and are no longer available on SunSolve.

Solaris 7 and 8 are not affected by this issue.


Sun has issued the following fixes:

SPARC Platform

     * Solaris 9 with patch 112908-13 or later

x86 Platform

     * Solaris 9 with patch 115168-04 or later

-----

     * Sun Alert ID: 57587
     * Synopsis: Solaris 9 Patches 112908-12 and 115168-03 WITHDRAWN, May Cause Passwords 
to be Logged as Clear Text on Kerberos Clients
     * Category: Security
     * Product: Solaris
     * BugIDs: 5004688
     * Avoidance: Patch, Workaround
     * State: Resolved
     * Date Released: 17-Jun-2004
     * Date Closed: 17-Jun-2004
     * Date Modified:

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC