PT-2005-3356 · Cerulean Studios · Trillian Pro

Suramya Tomar · Published 2005-08-03 · Updated 2017-07-11 · CVE-2005-2444

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trillian Pro version 3.1 build 121

Description The issue allows local users to obtain sensitive information due to the storage of passwords in plaintext in a world-readable file. This occurs when checking Yahoo e-mail, and the file is not deleted after login. The flaw may lead to unauthorized password exposure, specifically when the Check Mail function is used, potentially resulting in a loss of confidentiality.

Recommendations For Trillian Pro version 3.1 build 121, consider disabling the Check Mail function for Yahoo e-mail until a fix is available to prevent unauthorized access to sensitive information. Restrict access to the file that stores passwords in plaintext to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-2444

Affected Products

Trillian Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-2444 · Security Note
• http://secunia.com/advisories/16289 · Note
• http://marc.theaimsgroup.com/?l=bugtraq&m=112274667603628&w=2 · Note
• http://xforce.iss.net/xforce/xfdb/21667 · Note
• http://marc.info/?l=bugtraq&m=112274667603628&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21667 · Note