PT-2002-1329 · Instantservers · Instantservers Miniportal

Published 2002-05-03 · Updated 2016-10-18 · CVE-2002-0259

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions InstantServers MiniPortal versions 1.1.5 and earlier

Description The issue allows local users to gain privileges by accessing sensitive login and account data stored in plaintext. This data is stored in either .pwd files in the miniportal/apache directory or in the mplog.txt file.

Recommendations For InstantServers MiniPortal versions 1.1.5 and earlier, consider restricting access to the miniportal/apache directory and the mplog.txt file to minimize the risk of exploitation. As a temporary workaround, limit local user privileges until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2002-0259

Affected Products

Instantservers Miniportal

References · 5

• http://iss.net/security_center/static/8170.php · Vendor Advisory
• http://instantservers.com/releases.html · Vendor Advisory
• http://securityfocus.com/bid/4076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0259 · Security Note
• http://marc.info/?l=bugtraq&m=101329397901071&w=2 · Note