PT-2006-2214 · Comvigo · Comvigo Im Lock

Publicado 2006-03-14 · Atualizado 2018-10-18 · CVE-2006-1198

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Comvigo IM Lock version 2006

Description The issue concerns the use of a simple substitution cipher for password encryption in the product, which can be decrypted by local users. This allows users to bypass the blocking functionality of the product. The password is stored in the msnvsprc registry value, to which all users have Read permission.

Recommendations For Comvigo IM Lock version 2006, consider restricting access to the msnvsprc registry value to prevent local users from decrypting the password and bypassing the product's blocking functionality. As a temporary workaround, restrict the use of the product's blocking functionality until a more secure encryption method is implemented.

Correção

Identificadores relacionados

CVE-2006-1198

Produtos afetados

Comvigo Im Lock

Referências · 6

• http://vupen.com/english/advisories/2006/0866 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1198 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25219 · Nota
• http://securityfocus.com/bid/16988 · Nota
• http://secunia.com/advisories/19140 · Aviso do Fabricante
• http://securityfocus.com/archive/1/426935/100/0/threaded · Nota