CVE-2004-0653: Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an...

Security readout for executives and security teams

This CVE describes a credential leak in Solaris 9 Kerberos client configurations. If pam_krb5 authentication debug logging is enabled with specific Solaris patches, user passwords can be written to logs in plaintext. A local user who can read those logs may recover other users' passwords. Exposure appears narrow: legacy Solaris 9 hosts matching the Kerberos client, patch, pam_krb5 auth, and debug conditions. Risk is higher where local users can read authentication logs or where exposed credentials are reused across systems. Prioritize if Solaris 9 remains in use, especially in shared or multi-user environments. This is not a broad internet-facing vulnerability, but plaintext password logging can create serious downstream compromise if credentials are reused. Mitigation focus: Disable pam_krb5 debug logging on affected Solaris 9 Kerberos clients.; Review Sun/Oracle advisory guidance for corrected patches or supported remediation.; Restrict authentication log file permissions to authorized administrators only..

Prepared

Jun 30, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.