PT-2008-5859 · Websense · Websense Enterprise

Publicado 2008-10-21 · Atualizado 2011-03-08 · CVE-2008-4646

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Enterprise version 6.3.2

Description The issue concerns the storage of the SQL database system administrator password in plaintext within a log file, specifically CreateDbInstall.log, by the Websense Reporter Module. This allows local users to obtain the password and gain privileges to the database.

Recommendations For Websense Enterprise version 6.3.2, consider restricting access to the CreateDbInstall.log file to prevent unauthorized users from obtaining the database administrator password. Additionally, as a temporary workaround, manually encrypt or securely store the SQL database system administrator password until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-4646

Produtos afetados

Websense Enterprise

Referências · 6

• http://secunia.com/advisories/32264 · Aviso do Fabricante
• http://securityfocus.com/bid/31746 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4646 · Nota de Segurança
• http://securitytracker.com/id?1021058 · Nota
• http://vupen.com/english/advisories/2008/2819 · Nota
• http://zebux.org/pub/Advisory/Advisory_Websense_Reporter_Password_Disclosure_200810.txt · Nota