Solaris sadmind Disabled Authentication Vulnerability

BID:2354

Info

Solaris sadmind Disabled Authentication Vulnerability

Bugtraq ID: 2354
Class: Configuration Error
CVE:
Remote: Yes
Local: No
Published: Dec 09 1999 12:00AM
Updated: Apr 18 2006 09:36PM
Credit: Reported to bugtraq by CERT Coordination Center on Dec 9, 1999
Vulnerable: Sun SunOS 5.7 _x86
Sun SunOS 5.7
Sun SunOS 5.6 _x86
Sun SunOS 5.6
Sun SunOS 5.5.1 _x86
Sun SunOS 5.5.1
Sun SunOS 5.5
Sun Solaris 2.5.1 _x86
Sun Solaris 2.5.1
Sun Solaris 7.0_x86
Sun Solaris 7.0
Sun Solaris 2.6_x86
Sun Solaris 2.6
Sun Solaris 2.5_x86
Sun Solaris 2.5
Not Vulnerable:

Discussion

Solaris sadmind Disabled Authentication Vulnerability

Versions of 'sadmind' were shipped with a default of no authentication required. As a result, remote users could access the service and compromise the target system.

Exploit / POC

Solaris sadmind Disabled Authentication Vulnerability

No exploit is required for this vulnerability.

Solution / Fix

Solaris sadmind Disabled Authentication Vulnerability

Solution:
The following patches are available in relation to the above problem.

AdminSuite Version Patch ID
__________________ ________
2.3 104468-18 (see Note)
2.3_x86 104469-18 (see Note)

Note: Install patch if AdminSuite is installed. AdminSuite may be installed on SunOS 5.7, 5.6, 5.5.1, 5.5, 5.4 or 5.3.


Sun Solaris 2.6

Sun Solaris 7.0

Sun Solaris 2.6_x86

Sun Solaris 2.5

Sun Solaris 7.0_x86

Sun Solaris 2.5_x86

Sun Solaris 2.5.1 _x86

Sun Solaris 2.5.1

Sun SunOS 5.5.1 _x86

Sun SunOS 5.6 _x86

Sun SunOS 5.6

Sun SunOS 5.7 _x86

Sun SunOS 5.7

References

Solaris sadmind Disabled Authentication Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report