Sun Internet Mail Server Cleartext Passwords During Installation Vulnerability

Bugtraq ID:	1004
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 19 2000 12:00AM
Updated:	Feb 19 2000 12:00AM
Credit:	This vulnerability was posted to the Bugtraq mailing list on February 20, 2000 by Michal Krzysztofowicz <[email protected]>.
Vulnerable:	Sun Solaris ISP Server 2.0 - Sun Solaris 7.0_x86 - Sun Solaris 7.0
Not Vulnerable:

Sun Internet Mail Server Cleartext Passwords During Installation Vulnerability

A vulnerability exists in the Sun Internet Mail Server, as distributed as part of the Solaris ISP Server 2.0 package. During installation, a file named /tmp/sims_setup.dat is created. This file contains all of the passwords relevant to SIMS in cleartext, and is world readable.

Sun Internet Mail Server Cleartext Passwords During Installation Vulnerability

see discussion

Sun Internet Mail Server Cleartext Passwords During Installation Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

A suitable compromise may be to install the Solaris ISP Server package in single user mode, and remove the /tmp/sims_setup.dat file manually.

Sun Internet Mail Server Cleartext Passwords During Installation Vulnerability

References:

• Sunsolve Online(tm) (Sun Microsystems)