Vulnerability Note VU#523710

Sun Solaris patches may cause passwords to be logged in clear text

According to the Sun Security Alert:

This issue can occur on a Solaris system configured as a kerberos client with patch 112908-12 or 115168-03 installed and any service using pam_krb5 as an "auth" module. With the debug feature of pam_krb5 enabled, password authentication for the user will be logged in clear text at LOG_DEBUG level.

Sun has issued an advisory which addresses this issue. For more information on patches available for your system, please refer to Sun Security Alert: 57587.

Remove previous patch

Back out patch 112908-12 (SPARC platform) or 115168-03 (x86 platform).

Disable debug feature of pam_krb5

Search for any matching lines using the following command, and remove the "debug" entry from that line in the "/etc/pam.conf" (see pam.conf(4)) file:

$ egrep -e '[\\t ]*[^#].*pam_krb5.*debug' /etc/pam.conf

1. Remove or comment out entries in the "etc/syslog.conf" (see syslog.conf(4)) file that match output from the following command:


$ egrep -e '\*.debug|daemon.debug' /etc/syslog.conf

2. Send a SIGHUP to syslogd:


$ pkill -HUP syslog

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57587
http://www.securitytracker.com/alerts/2004/Jun/1010530.html

Credit

This vulnerability was reported by Sun Microsystems Inc.

This document was written by Damon Morda.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.