PT-2005-3356 · Cerulean Studios · Trillian Pro

Suramya Tomar · Publicado 2005-08-03 · Atualizado 2017-07-11 · CVE-2005-2444

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trillian Pro version 3.1 build 121

Description The issue allows local users to obtain sensitive information due to the storage of passwords in plaintext in a world-readable file. This occurs when checking Yahoo e-mail, and the file is not deleted after login. The flaw may lead to unauthorized password exposure, specifically when the Check Mail function is used, potentially resulting in a loss of confidentiality.

Recommendations For Trillian Pro version 3.1 build 121, consider disabling the Check Mail function for Yahoo e-mail until a fix is available to prevent unauthorized access to sensitive information. Restrict access to the file that stores passwords in plaintext to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-2444

Produtos afetados

Trillian Pro

Referências · 6

• http://secunia.com/advisories/16289 · Nota
• http://marc.theaimsgroup.com/?l=bugtraq&m=112274667603628&w=2 · Nota
• http://xforce.iss.net/xforce/xfdb/21667 · Nota
• http://marc.info/?l=bugtraq&m=112274667603628&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21667 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2444 · Nota de Segurança