CVE-2011-0412
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable...
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable permissions under /var/sadm/pkg/, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
Exploit likelihood
What each source reports
NVD Score used
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable permissions under /var/sadm/pkg/, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
- Record
CVE-2011-0412- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable permissions under /var/sadm/pkg/, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
- Record
CVE-2011-0412- Updated
- 2026-11-02
EUVDEUVD-2011-0438 No score
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable permissions under /var/sadm/pkg/, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
- Record
EUVD-2011-0438- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4qg-rgm7-vgvv No score
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable...
Oracle Solaris 8, 9, and 10 stores back-out patch files (undo.Z) unencrypted with world-readable permissions under /var/sadm/pkg/, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
- Record
GHSA-x4qg-rgm7-vgvv- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0412 is a low vulnerability (CVSS 2.1) in Sun Sunos, published April 19, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. No source names a fixed version.
References
oracle.com/technetwork/topics/security/cpuapr2011-301950.html
secunia.com/advisories/44047
kb.cert.org/vuls/id/648244
exchange.xforce.ibmcloud.com/vulnerabilities/66579
securityfocus.com/bid/47171
osvdb.org/71646
vupen.com/english/advisories/2011/0882
nvd.nist.gov/vuln/detail/CVE-2011-0412
github.com/advisories/GHSA-x4qg-rgm7-vgvv