Sun Solaris Patches 112908-12 And 115168-03 Clear Text Password Logging Vulnerability

Bugtraq ID:	10606
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 17 2004 12:00AM
Updated:	Jun 17 2004 12:00AM
Credit:	The individual responsible for discovery of this issue is not currently known; this issue was disclosed in the referenced vendor advisory.
Vulnerable:	Sun Patch 115168-03 + Sun Solaris 9_x86 Sun Patch 112908-12 + Sun Solaris 9
Not Vulnerable:

Sun Solaris Patches 112908-12 And 115168-03 Clear Text Password Logging Vulnerability

Sun Solaris patches 112908-12 and 115168-03 are affected by a clear text password logging vulnerability. This issue is due to a design error that fails to secure sensitive information while logging activity.

This issue may allow a local attacker to harvest passwords for users of the affected computer; it is currently not known whether the attacker must have privileged access to the affected computer to view the offending files.

Sun Solaris Patches 112908-12 And 115168-03 Clear Text Password Logging Vulnerability

No exploit is required to exploit this vulnerability.

Sun Solaris Patches 112908-12 And 115168-03 Clear Text Password Logging Vulnerability

Solution:
Sun has released Sun Alert Notification 57587 dealing with this issue; patches for the vulnerable patches have been made available. Please see the referenced advisory for more information.


Sun Patch 115168-03

• Sun 115168-04
  http://sunsolve.sun.com/pub-cgi/115168-04.zip

Sun Patch 112908-12

• Sun 112908-13
  http://sunsolve.sun.com/pub-cgi/112908-13.zip

Sun Solaris Patches 112908-12 And 115168-03 Clear Text Password Logging Vulnerability

References:

• Sun Alert ID: 57587 (Sun Microsystems)