PT-2006-5331 · Hewlett Packard · Openvms+2

Publicado 2006-09-05 · Atualizado 2017-07-20 · CVE-2006-4537

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenVMS ALPHA versions 7.3-2 through 8.2

Description The issue allows local users to obtain passwords by reading an audit log file after a successful connection following a "network breakin" event. This occurs because NET$SESSION CONTROL.EXE in DECnet-Plus writes the password to the log file.

Recommendations For OpenVMS ALPHA versions 7.3-2 through 8.2, consider restricting access to the audit log file to minimize the risk of password exposure until a fix is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2006-4537

Produtos afetados

Hp Decnet-Plus

Net$Session Control.Exe

Openvms

Referências · 11

• https://exchange.xforce.ibmcloud.com/vulnerabilities/28695 · Nota
• http://securitytracker.com/id?1016772 · Nota
• http://secunia.com/advisories/21705 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-4537 · Nota de Segurança
• http://secunia.com/advisories/23632 · Aviso do Fabricante
• http://osvdb.org/28272 · Nota
• http://securityfocus.com/bid/19783 · Correção
• http://vupen.com/english/advisories/2006/3423 · Aviso do Fabricante
• http://securitytracker.com/id?1017472 · Nota
• ftp://ftp.itrc.hp.com/openvms_patches/alpha/V7.3-2/AXP_DNVOSIECO03-V732.txt · Nota
• ftp://ftp.itrc.hp.com/openvms_patches/alpha/V8.2/AXP_DNVOSIECO02-V82.txt · Nota