ID CVE-2011-0412
Summary Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable permissions under /var/sadm/pkg/, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
References
Vulnerable Configurations
  • Sun SunOS (Solaris 8) 5.8
    cpe:2.3:o:sun:sunos:5.8
  • Sun SunOS (Solaris 9) 5.9
    cpe:2.3:o:sun:sunos:5.9
  • Sun SunOS (Solaris 10) 5.10
    cpe:2.3:o:sun:sunos:5.10
CVSS
Base: 2.1 (as of 20-04-2011 - 09:12)
Impact:
Exploitability:
CWE CWE-255
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS8_X86_110935.NASL
    description SunOS 5.8_x86: package utilites patch. Date this patch was last updated by Sun : Aug/19/08
    last seen 2018-09-02
    modified 2014-08-30
    plugin id 13462
    published 2004-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=13462
    title Solaris 8 (x86) : 110935-28
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS8_110934.NASL
    description SunOS 5.8: package utilities patch. Date this patch was last updated by Sun : Aug/19/08
    last seen 2018-09-01
    modified 2014-08-30
    plugin id 13358
    published 2004-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=13358
    title Solaris 8 (sparc) : 110934-28
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_119254-92.NASL
    description SunOS 5.10: Install and Patch Utilities Patch. Date this patch was last updated by Sun : Jun/11/15
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107316
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107316
    title Solaris 10 (sparc) : 119254-92
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_119255-92.NASL
    description SunOS 5.10_x86: Install and Patch Utilities Patch. Date this patch was last updated by Sun : Jun/11/15
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107819
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107819
    title Solaris 10 (x86) : 119255-92
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_119254-91.NASL
    description SunOS 5.10: Install and Patch Utilities Pa. Date this patch was last updated by Sun : Feb/23/15
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107315
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107315
    title Solaris 10 (sparc) : 119254-91
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_119255-91.NASL
    description SunOS 5.10_x86: Install and Patch Utilitie. Date this patch was last updated by Sun : Feb/23/15
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107818
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107818
    title Solaris 10 (x86) : 119255-91
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_119255.NASL
    description SunOS 5.10_x86: Install and Patch Utilities Patch. Date this patch was last updated by Sun : Mar/29/16 This plugin has been deprecated and either replaced with individual 119255 patch-revision plugins, or deemed non-security related.
    last seen 2019-02-21
    modified 2018-07-30
    plugin id 22302
    published 2006-09-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22302
    title Solaris 10 (x86) : 119255-93 (deprecated)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_119254.NASL
    description SunOS 5.10: Install and Patch Utilities Patch. Date this patch was last updated by Sun : Mar/29/16 This plugin has been deprecated and either replaced with individual 119254 patch-revision plugins, or deemed non-security related.
    last seen 2019-02-21
    modified 2018-07-30
    plugin id 22244
    published 2006-08-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22244
    title Solaris 10 (sparc) : 119254-93 (deprecated)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS9_113713.NASL
    description SunOS 5.9: pkg utilities Patch. Date this patch was last updated by Sun : Apr/05/11
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 13543
    published 2004-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=13543
    title Solaris 9 (sparc) : 113713-30
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS9_X86_114568.NASL
    description SunOS 5.9_x86: pkg utilities Patch. Date this patch was last updated by Sun : Apr/05/11
    last seen 2018-09-02
    modified 2016-12-09
    plugin id 13606
    published 2004-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=13606
    title Solaris 9 (x86) : 114568-29
refmap via4
bid 47171
cert-vn VU#648244
confirm http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
osvdb 71646
secunia 44047
vupen ADV-2011-0882
xf solaris-password-info-disclosure(66579)
Last major update 20-04-2011 - 00:00
Published 19-04-2011 - 15:55
Last modified 16-08-2017 - 21:33
Back to Top