Synopsis: SMC Default Configuration GUI Creates User Accounts With Blank Password Instead of Locked Account
Category: Security
Product: Solaris, Solaris Management Console (SMC)
BugIDs: 4997883
Avoidance: Patch, Workaround
State: Resolved
Date Released: 10-Jan-2005
Date Closed: 10-Jan-2005
Date Modified:
1. Impact
User accounts created with the Solaris Management Console (SMC) GUI which are configured for password aging (the shadow(4) fields <min> and <max> fields will be set) may allow login without specifying a password.
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
Note: Solaris 7 is not affected by this issue.
3. Symptoms
This issue can occur when a user account is created with SMC (default configuration) with aging fields set and no password supplied. The user account (when being created) is not prompted for a password.
4. Relief/Workaround
To work around the described issue, always supply a password while creating user accounts with SMC (locked by default).
5. Resolution
This issue is resolved in the following releases:
SPARC Platform
Note: Both patches listed for each version of Solaris must be installed to resolve this issue.
This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use.
This Sun Alert notification may only be used for the purposes contemplated by these agreements.Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.