PT-2006-1690 · Invision · Invision Power Board

Publicado 2006-02-10 · Atualizado 2013-01-03 · CVE-2006-0633

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board version 2.1.4

Description The issue concerns the generation of authentication codes for lost passwords. Specifically, the make password function in ipsclass.php uses random data generated from partially predictable seeds, which could make it easier for remote attackers to guess the code. This might allow attackers to change the password for an account, potentially involving a large number of requests.

Recommendations For Invision Power Board version 2.1.4, consider modifying the make password function to use more unpredictable seeds for generating authentication codes, or implement additional security measures to prevent brute-force guessing of the authentication code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2006-0633

Produtos afetados

Invision Power Board

Referências · 4

• http://forums.invisionpower.com/lofiversion/index.php/t200085.html · Nota
• http://r-security.net/tutorials/view/readtutorial.php?id=4 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0633 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0633 · Nota de Segurança