CVE-1999-0982: High severity Sun Web-Based Enterprise Management vulnerability
The Sun Web-Based Enterprise Management (WBEM) installation script stores a password in plaintext in a world readable file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change permissions on the file created by the WBEM installation script so it is not world-readable; restrict access to the owning administrative account (for example, set owner-only permissions such as chmod 600 or apply equivalent filesystem ACLs).
Sun Web-Based Enterprise Management (WBEM) installation script file permissions = remove world-readable - Configuration
Modify the installation script or its configuration so it does not store passwords in plaintext. Use a secure credential store or encrypt secrets at rest instead of writing cleartext passwords to files.
Sun Web-Based Enterprise Management (WBEM) installation script password storage = do not store plaintext - Compensating control
Until the script is fixed, restrict access to the host and filesystem containing the file so only trusted administrators can read it (apply host-level ACLs, tighten filesystem permissions, and limit network/management access to trusted IPs).
- Operational
Locate any plaintext password files produced by the WBEM installer, remove or sanitize those files, and rotate the affected credentials (change the passwords) for any accounts that were stored in plaintext.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0982?
CVE-1999-0982 is classified as a moderate severity vulnerability due to the exposure of plaintext passwords.
How do I fix CVE-1999-0982?
To fix CVE-1999-0982, ensure that the installation script does not store passwords in plaintext and restrict access to sensitive files.
What systems are affected by CVE-1999-0982?
CVE-1999-0982 affects Sun Web-Based Enterprise Management versions 1.0 and 2.0, as well as Oracle Solaris 8.0 beta.
Why is CVE-1999-0982 a security risk?
CVE-1999-0982 poses a security risk because it allows unauthorized users to read sensitive passwords stored in world-readable files.
Is there a patch available for CVE-1999-0982?
There is no specific patch for CVE-1999-0982, but mitigating measures should be implemented to enhance file security.