PT-2007-7197 · Meridian · Meridian Prolog Manager

Publicado 2007-12-13 · Atualizado 2018-10-15 · CVE-2007-6330

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Meridian Prolog Manager versions 2007, 7.5 and earlier

Description The issue allows remote attackers to obtain database access by capturing credentials via a man-in-the-middle attack, as it sends all usernames and passwords to the client in a cleartext or weakly encrypted format to support client-side login authentication.

Recommendations For Meridian Prolog Manager versions 2007, 7.5 and earlier, consider disabling client-side login authentication until a secure method for transmitting credentials is implemented. Restrict access to sensitive areas of the database to minimize the risk of exploitation. Avoid using weak encryption for transmitting usernames and passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-6330

Produtos afetados

Meridian Prolog Manager

Referências · 8

• http://kb.cert.org/vuls/id/120593 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38996 · Nota
• http://securityfocus.com/archive/1/484886/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6330 · Nota de Segurança
• http://osvdb.org/42634 · Nota
• http://kb.cert.org/vuls/id/MIMG-77FL3T · Nota
• http://securityfocus.com/bid/26826 · Nota
• http://secunia.com/advisories/28065 · Nota