PT-2013-4526 · Baramundi · Baramundi Management Suite

Damir Bozic · Publicado 2013-10-03 · Atualizado 2013-10-03 · CVE-2013-3625

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Baramundi Management Suite versions 7.5 through 8.9

Description The issue involves an unspecified DLL file in the software that uses a hardcoded encryption key. This makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.

Recommendations For versions 7.5 through 8.9, consider restricting access to the affected DLL file until a patch is available. As a temporary workaround, avoid using the cryptographic protection mechanisms that rely on the hardcoded encryption key. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2013-3625

Produtos afetados

Baramundi Management Suite

Referências · 2

• http://kb.cert.org/vuls/id/392654 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3625 · Nota de Segurança