PT-2006-6025 · Secure Computing · Secure Computing Safeword Remoteaccess

Publicado 2006-10-17 · Atualizado 2017-07-20 · CVE-2006-5303

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Secure Computing SafeWord RemoteAccess version 2.1

Description The issue allows local users to obtain sensitive information, including the UserCenter web portal password, database encryption keys, and signing keys. This is achieved by reading base-64 encoded data in the login.conf file and plaintext data in the signers.cfg file. The locations of these files are SERVERSWebTomcatusercenterWEB-INF and SERVERSShared, respectively.

Recommendations For Secure Computing SafeWord RemoteAccess version 2.1, consider restricting access to the SERVERSWebTomcatusercenterWEB-INF and SERVERSShared directories to minimize the risk of exploitation. Avoid storing sensitive information in plaintext files like signers.cfg. As a temporary workaround, limit local user access to these directories until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2006-5303

Produtos afetados

Secure Computing Safeword Remoteaccess

Referências · 4

• http://secunia.com/advisories/22081 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29515 · Nota
• http://securityfocus.com/bid/20509 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5303 · Nota de Segurança