PT-2001-2635 · Centra · Centraone+1

Published 2001-12-31 · Updated 2017-07-11 · CVE-2001-1550

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CentraOne version 5.2 Centra ASP (affected versions not specified)

Description The issue allows local users to obtain cleartext passwords from decoded log files and impersonate users due to the creation of world-writable base64 encoded log files when basic authentication is enabled.

Recommendations For CentraOne version 5.2, consider disabling basic authentication to prevent the creation of world-writable log files. For Centra ASP, restrict access to the log files to minimize the risk of exploitation until a more specific fix is provided. As a temporary workaround, consider implementing additional access controls to the log files to prevent unauthorized access.

Fix

Related Identifiers

CVE-2001-1550

Affected Products

Centra Asp

Centraone

References · 5

• http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0072.html · Vendor Advisory
• http://archives.neohapsis.com/archives/ntbugtraq/2001-q4/0205.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1550 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7820 · Note
• http://securityfocus.com/bid/3704 · Note