PT-2017-7737 · Hitek · Automize

Publicado 2017-01-23 · Atualizado 2017-03-16 · CVE-2016-10104

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitek Software's Automize versions 10.0 through 10.25 Hitek Software's Automize versions 11.0 through 11.14

Description The issue allows an attacker to recover encrypted passwords for SSH/SFTP profiles due to the Read attribute being set for Users in sshProfiles.jsd. This can lead to Information Disclosure.

Recommendations For versions 10.0 through 10.25, restrict access to the sshProfiles.jsd file to minimize the risk of exploitation. For versions 11.0 through 11.14, consider disabling the Read attribute for Users in sshProfiles.jsd until a patch is available. As a temporary workaround, avoid using the SSH/SFTP profiles in Automize until the issue is resolved.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2016-10104

Produtos afetados

Automize

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10104 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10104 · Aviso do Fabricante
• http://securityfocus.com/bid/96845 · Nota
• https://rastamouse.me/guff/2016/automize · Nota