Description
Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even when the user logging into ssh is not root, which makes it easier for attackers to avoid detection and can make it more difficult to conduct forensics activities.
References
- 201310 vendor-advisory
- solaris-sshaudit-weak-security(39185) vdb-entry
- 44332 vdb-entry
- oval:org.mitre.oval:def:5282 vdb-entry signature
- 103172 vendor-advisory