PT-2006-5331 · Hewlett Packard · Openvms+2

Published 2006-09-05 · Updated 2017-07-20 · CVE-2006-4537

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenVMS ALPHA versions 7.3-2 through 8.2

Description The issue allows local users to obtain passwords by reading an audit log file after a successful connection following a "network breakin" event. This occurs because NET$SESSION CONTROL.EXE in DECnet-Plus writes the password to the log file.

Recommendations For OpenVMS ALPHA versions 7.3-2 through 8.2, consider restricting access to the audit log file to minimize the risk of password exposure until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-4537

Affected Products

Hp Decnet-Plus

Net$Session Control.Exe

Openvms

References · 11

• http://secunia.com/advisories/21705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4537 · Security Note
• http://secunia.com/advisories/23632 · Vendor Advisory
• http://securityfocus.com/bid/19783 · Patch
• http://vupen.com/english/advisories/2006/3423 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28695 · Note
• http://securitytracker.com/id?1016772 · Note
• http://osvdb.org/28272 · Note
• http://securitytracker.com/id?1017472 · Note
• ftp://ftp.itrc.hp.com/openvms_patches/alpha/V7.3-2/AXP_DNVOSIECO03-V732.txt · Note
• ftp://ftp.itrc.hp.com/openvms_patches/alpha/V8.2/AXP_DNVOSIECO02-V82.txt · Note