PT-2006-3639 · Microsoft+1 · Sql Server+2

Robert Passlow · Publicado 2006-06-01 · Atualizado 2018-10-18 · CVE-2006-2719

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions JIWA Financials version 6.4.14

Description The issue allows context-dependent attackers to potentially obtain passwords because JIWA Financials stores usernames and passwords in cleartext in the HR Staff table in Microsoft SQL Server. It also sends these credentials in cleartext to the application's SQL Server ODBC driver.

Recommendations For JIWA Financials version 6.4.14, consider implementing encryption for storing and transmitting usernames and passwords to prevent them from being obtained in cleartext. As a temporary workaround, restrict access to the HR Staff table and the SQL Server ODBC driver to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-2719

Produtos afetados

Jiwa Financials

Sql Server

Odbc Driver For Sql Server

Referências · 6

• 🔥 http://secunia.com/advisories/20342 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046398.html · Exploit
• http://securityreason.com/securityalert/1000 · Nota
• http://securitytracker.com/id?1016181 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2719 · Nota de Segurança
• http://securityfocus.com/archive/1/435352/100/0/threaded · Nota