PT-2005-4210 · Eyeos · Eyeos

Published 2005-11-01 · Updated 2017-07-11 · CVE-2005-3414

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eyeOS version 0.8.4

Description The issue allows remote attackers to obtain user credentials due to insufficient access control of the usrinfo.xml file, which is stored under the web document root.

Recommendations For eyeOS version 0.8.4, consider restricting access to the usrinfo.xml file to prevent remote attackers from obtaining user credentials. As a temporary workaround, restrict access to the web document root until a proper fix is applied.

Fix

Related Identifiers

CVE-2005-3414

Affected Products

Eyeos

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-3414 · Security Note
• http://thebillygoatcurse.com/advisories/eyeOS_0.8.4_Multiple.pdf · Vendor Advisory
• http://secunia.com/advisories/17105 · Vendor Advisory
• http://securityfocus.com/bid/15256 · Note
• http://osvdb.org/20411 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22938 · Note
• http://vupen.com/english/advisories/2005/2259 · Note