PT-2004-3446 · Riverdeep · Riverdeep Foolproof Security

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2555

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Riverdeep FoolProof Security versions 3.9.x

Description The issue concerns the use of weak cryptography, specifically arithmetic and XOR operations, to relate the Control password to the Administrator password. This weakness allows local users to calculate the Administrator password if they know the Control password and the password recovery key.

Recommendations For Riverdeep FoolProof Security version 3.9.x, consider changing the Control password and the Administrator password to strong, unique passwords, and keep the password recovery key secure to minimize the risk of exploitation. As a temporary workaround, restrict access to the password recovery mechanism until a more secure method is implemented.

Exploit

Fix

Related Identifiers

CVE-2004-2555

Affected Products

Riverdeep Foolproof Security

References · 7

• 🔥 http://osvdb.org/6735 · Exploit
• 🔥 http://securityfocus.com/bid/10467 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0081.html · Exploit
• 🔥 https://exploit-db.com/exploits/24171 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2555 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16327 · Note
• http://secunia.com/advisories/11790 · Note