what you don't know can hurt you

57717.html

57717.html
Posted Jan 16, 2005
Site sunsolve.sun.com

Sun Security Advisory - User accounts created with the Solaris Management Console (SMC) GUI which are configured for password aging may allow login without specifying a password.

tags | advisory
systems | solaris
MD5 | a5ab82c79195d43cec5e7a170b1ab56e

57717.html

Change Mirror Download









<html>
<head>
<title>SunSolve Printer Friendly Page</title>
<LINK REL="Stylesheet" TYPE="text/css" TITLE="Sunstyle" HREF="/style.css">
<script language="JavaScript" src="/s_code_remote.js">
</head>
<body>

<script language="JavaScript">
<!--
var s_pageName=document.title;
var s_channel="CDS Print-Friendly page"
//--></script>
<STYLE MEDIA="screen" TYPE="text/css"><!--
pre { white-space:-moz-pre-wrap; word-wrap:break-word; margin:0px }
--></STYLE><table border="0" cellspacing="0" cellpadding="2" width="100%"><tr><td nowrap="" width="3%" valign="top"><b>Document Audience:</b></td><td valign="top" align="left"><cds:audience xmlns:cds="http://cds.central" xmlns:xlink="http://www.w3.org/1999/xlink">PUBLIC</cds:audience></td></tr><tr><td nowrap="" width="3%" valign="top"><b>Document ID:</b></td><td valign="top" align="left"><cds:source-id xmlns:cds="http://cds.central" xmlns:xlink="http://www.w3.org/1999/xlink">57717</cds:source-id></td></tr><tr><td nowrap="" width="3%" valign="top"><b>Title:</b></td><td valign="top" align="left">Document ID 57717</td></tr><tr><td nowrap="" width="3%" valign="top"><b>Synopsis:</b></td><td valign="top" align="left">SMC Default Configuration GUI Creates User Accounts With Blank Password Instead of Locked Accounts </td></tr><tr><td nowrap="" width="3%" valign="top"><b>Update Date:</b></td><td valign="top" align="left">2005-01-11</td></tr></table><hr><table border="0" cellspacing="0" cellpadding="2" width="100%"><tr bgcolor="#999999"><td><font color="#ffffff" size="2"><b>Description</b></font></td><td align="right"><b><a href="#top"><font color="#ffffff" size="2">Top</font></a></b></td></tr></table><b>
Sun(sm) Alert Notification
</b><ul><li>
Sun Alert ID: 57717
</li><li>
Synopsis: SMC Default Configuration GUI Creates User Accounts With Blank Password Instead of Locked Account
</li><li>
Category: Security
</li><li>
Product: Solaris, Solaris Management Console (SMC)
</li><li>
BugIDs: 4997883
</li><li>
Avoidance: Patch, Workaround
</li><li>
State: Resolved
</li><li>
Date Released: 10-Jan-2005
</li><li>
Date Closed: 10-Jan-2005
</li><li>
Date Modified:
</li></ul><b>
1. Impact
</b>
User accounts created with the Solaris Management Console (SMC) GUI which are configured for password aging (the shadow(4) fields <min> and <max> fields will be set) may allow login without specifying a password.
<p></p><b>
2. Contributing Factors
</b>
This issue can occur in the following releases:
<p></p>
<b>SPARC Platform</b>
<p></p><ul><li>
Solaris 8 without patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-113749-02-1">113749-02</a> and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-109134-31-1">109134-31</a>
</li><li>
Solaris 9 without patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-114503-08-1">114503-08</a> and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-112945-29-1">112945-29</a>
</li></ul>
<b>x86 Platform</b>
<p></p><ul><li>
Solaris 8 without patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-113750-02-1">113750-02</a> and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-109135-31-1">109135-31</a>
</li><li>
Solaris 9 without patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-114504-08-1">114504-08</a> and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-114193-20-1">114193-20</a>
</li></ul>
<b>Note: </b>Solaris 7 is not affected by this issue.
<p></p><b>
3. Symptoms
</b>
This issue can occur when a user account is created with SMC (default configuration) with aging fields set and no password supplied. The user account (when being created) is not prompted for a password.
<p></p>
<table border="0" cellspacing="0" cellpadding="2" width="100%"><tr bgcolor="#999999"><td><font color="#ffffff" size="2"><b>Solution Summary</b></font></td><td align="right"><b><a href="#top"><font color="#ffffff" size="2">Top</font></a></b></td></tr></table><b>
4. Relief/Workaround
</b>
To work around the described issue, always supply a password while creating user accounts with SMC (locked by default).
<p></p><b>
5. Resolution
</b>
This issue is resolved in the following releases:
<p></p>
<b>SPARC Platform</b>
<p></p><ul><li>
Solaris 8 with patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-113749-02-1">113749-02</a> or later and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-109134-31-1">109134-31</a> or later
</li><li>
Solaris 9 with patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-114503-08-1">114503-08</a> or later and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-112945-29-1">112945-29</a> or later
</li></ul>
<b>x86 Platform</b>
<p></p><ul><li>
Solaris 8 with patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-113750-02-1">113750-02</a> or later and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-109135-31-1">109135-31</a> or later
</li><li>
Solaris 9 with patches <a href="/search/document.do?assetkey=urn:cds:docid:1-21-114504-08-1">114504-08</a> or later and <a href="/search/document.do?assetkey=urn:cds:docid:1-21-114193-20-1">114193-20</a> or later
</li></ul>
<b>Note:</b> Both patches listed for each version of Solaris must be installed to resolve this issue.
<p></p>
<i>This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use.
This Sun Alert notification may only be used for the purposes contemplated by these agreements.</i>
<p></p>
<i>Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.</i>
<p></p>
<table border="0" cellspacing="0" cellpadding="2" width="100%"><tr><td width="25%" valign="top" bgcolor="#999999"><font size="2" color="#ffffff"><b>Applies To</b></font></td><td width="75%" valign="top" bgcolor="#cccccc"><font size="2">
</font></td></tr></table><p></p><table border="0" cellspacing="0" cellpadding="2" width="100%"><tr><td width="25%" valign="top" bgcolor="#999999"><font size="2" color="#ffffff"><b>Attachments</b></font></td><td width="75%" valign="top" bgcolor="#cccccc"><font size="2"> </font></td></tr></table><p></p>
</body>
</html>

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    1 Files
  • 2
    Dec 2nd
    16 Files
  • 3
    Dec 3rd
    17 Files
  • 4
    Dec 4th
    23 Files
  • 5
    Dec 5th
    11 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close