PT-2006-2214 · Comvigo · Comvigo Im Lock

Published 2006-03-14 · Updated 2018-10-18 · CVE-2006-1198

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Comvigo IM Lock version 2006

Description The issue concerns the use of a simple substitution cipher for password encryption in the product, which can be decrypted by local users. This allows users to bypass the blocking functionality of the product. The password is stored in the msnvsprc registry value, to which all users have Read permission.

Recommendations For Comvigo IM Lock version 2006, consider restricting access to the msnvsprc registry value to prevent local users from decrypting the password and bypassing the product's blocking functionality. As a temporary workaround, restrict the use of the product's blocking functionality until a more secure encryption method is implemented.

Fix

Related Identifiers

CVE-2006-1198

Affected Products

Comvigo Im Lock

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-1198 · Security Note
• http://secunia.com/advisories/19140 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0866 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25219 · Note
• http://securityfocus.com/bid/16988 · Note
• http://securityfocus.com/archive/1/426935/100/0/threaded · Note