PT-2006-6189 · Oneorzero · Oneorzero Helpdesk

Publicado 2006-10-24 · Atualizado 2018-10-17 · CVE-2006-5474

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OneOrZero Helpdesk versions prior to 1.6.5.4

Description The issue concerns the "forgot password" function, which generates insecure passwords. This is done by concatenating the current timestamp with the username, allowing remote attackers to gain access as an arbitrary user by requesting a password reset.

Recommendations For versions prior to 1.6.5.4, update to version 1.6.5.4 or later to resolve the issue. As a temporary workaround, consider disabling the "forgot password" function until a patch is available. Restrict access to the password reset feature to minimize the risk of exploitation. Avoid using the username in conjunction with the password reset mechanism until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-5474

Produtos afetados

Oneorzero Helpdesk

Referências · 7

• 🔥 http://whitedust.net/speaks/3043 · Exploit
• http://secunia.com/advisories/22476 · Aviso do Fabricante
• http://securityreason.com/securityalert/1767 · Nota
• http://securityfocus.com/bid/20651 · Nota
• http://securityfocus.com/archive/1/449352/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5474 · Nota de Segurança
• http://oneorzero.com/downloads/release_notes/Current_Release_notes.html · Correção