Vulnerability CVE-2003-0047
Published: 2003-02-19   Modified: 2012-02-12

Description:
SSH2 clients for VanDyke (1) SecureCRT 4.0.2 and 3.4.7, (2) SecureFX 2.1.2 and 2.0.4, and (3) Entunnel 1.0.2 and earlier, do not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.6/10
6.4/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Van dyke technologies -> Entunnel 
Van dyke technologies -> Securecrt 
Van dyke technologies -> Securefx 

 References:
http://marc.info/?l=bugtraq&m=104386492422014&w=2
http://www.idefense.com/advisory/01.28.03.txt
http://www.securityfocus.com/bid/6726
http://www.securityfocus.com/bid/6727
http://www.securityfocus.com/bid/6728
http://www.securitytracker.com/id?1006010
http://www.securitytracker.com/id?1006011
http://www.securitytracker.com/id?1006012
Copyright 2024, cxsecurity.com

 

Back to Top