Sun Solaris Sun Update Connection Web Proxy Password Disclosure Vulnerability

Bugtraq ID:	15772
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 07 2005 12:00AM
Updated:	Dec 07 2005 12:00AM
Credit:	Discovery is credited to Nicholas Brealey of Culham Electromagnetics and Lightning.
Vulnerable:	Sun Solaris 10.0_x86 Sun Solaris 10
Not Vulnerable:

Sun Solaris Sun Update Connection Web Proxy Password Disclosure Vulnerability

Sun Solaris Sun Update Connection is prone to a vulnerability that may allow local attackers to obtain the proxy server password.

This vulnerability only presents itself when Sun Update Connection is configured to use a Web proxy with password authentication enabled.

A successful attack may result in information disclosure, which may lead to other attacks as well.

Solaris 10 is prone to this vulnerability.

Sun Solaris Sun Update Connection Web Proxy Password Disclosure Vulnerability

An exploit is not required.

Sun Solaris Sun Update Connection Web Proxy Password Disclosure Vulnerability

Solution:
Sun has released an advisory (Sun Alert ID: 102090) including patches to address this issue. Please see the referenced advisory for more information.

Sun Solaris Sun Update Connection Web Proxy Password Disclosure Vulnerability

References:

• Sun Alert ID: 102090 (Sun)