Insecure storage of passwords in Axalto Protiva

2006.10.31
Credit: nnposter
Risk: Low
Local: Yes
Remote: No
CWE: CWE-Other


Ogólna skala CVSS: 2.1/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 3.9/10
Wymagany dostęp: Lokalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

Insecure storage of passwords in Axalto Protiva Critical: Less critical Impact: Exposure of sensitive information Where: Local system Software: Axalto Protiva 1.1 http://www.protiva.axalto.com/ (Note: Vendor claims that it impacts only "non-commercial" versions or whatever that means in reality.) Description: A vulnerability has been identified in Axalto Protiva, which can be exploited by malicious, local users to gain knowledge and manipulate sensitive information. The vulnerability is caused due to storing application passwords as plaintext in files that are by default readable by all non-privileged users: Keystore password in (application directory)KeyToolkeytool.config Keystore password and Active Directory LDAP access credentials in (Tomcat directory)webappsprotivaWEB-INFclassesauthserver.config The vulnerability has been identified in version 1.1. However, other versions may be also affected. Solution: Set proper ACLs on the application directories. Restrict local login rights to privileged users. Found by: nnposter


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top