PT-2001-1367 · Interscan · Interscan Viruswall

Publicado 2001-02-14 · Atualizado 2008-09-05 · CVE-2001-0133

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Interscan VirusWall versions 3.6.x and earlier

Description: The issue concerns the web administration interface of the affected software, which does not utilize encryption. This could potentially allow remote attackers to obtain the administrator password by sniffing it via the setpasswd.cgi program or other HTTP GET requests that contain base64 encoded usernames and passwords.

Recommendations: For Interscan VirusWall versions 3.6.x and earlier, consider disabling the setpasswd.cgi program and restricting access to the web administration interface until a fix is available. Avoid using HTTP GET requests that contain base64 encoded usernames and passwords to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2001-0133

Produtos afetados

Interscan Viruswall

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0133 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2001-01/0235.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-0133 · Nota de Segurança
• http://securityfocus.com/bid/2212 · Aviso do Fabricante