PT-2006-2387 · Passwordsafe · Passwordsafe

Published 2006-03-24 · Updated 2018-10-18 · CVE-2006-1378

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions PasswordSafe version 3.0 beta

Description The issue concerns the use of a weak random number generator, specifically the C++ rand function, during the generation of the database encryption key. This weakness makes it easier for attackers to decrypt the database and steal passwords by generating keys for all possible rand() seed values and conducting a known plaintext attack.

Recommendations For PasswordSafe version 3.0 beta, consider using an alternative, more secure random number generator to mitigate the risk of decryption by attackers. As a temporary workaround, restrict access to sensitive data stored in the database until a more secure version is available.

Exploit

Fix

Related Identifiers

CVE-2006-1378

Affected Products

Passwordsafe

References · 6

• 🔥 http://securityfocus.com/bid/17200 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1378 · Security Note
• http://securityfocus.com/archive/1/445509/100/0/threaded · Note
• http://securityreason.com/securityalert/618 · Note
• http://securityfocus.com/archive/1/428552/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25429 · Note