RSS   Vulnerabilities for 'Second life'   RSS

2007-09-18
 
CVE-2007-4961

CWE-255
 

 
The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server.

 
 
CVE-2007-4960

CWE-DesignError
 

 
Argument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler, as used in Internet Explorer and possibly Firefox, allows remote attackers to obtain sensitive information via a '" ' (double-quote space) sequence followed by the -autologin and -loginuri arguments, which cause the handler to post login credentials and software installation details to an arbitrary URL.

 


Copyright 2017, cxsecurity.com

 

Back to Top