PT-2006-6189 · Oneorzero · Oneorzero Helpdesk

Published 2006-10-24 · Updated 2018-10-17 · CVE-2006-5474

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OneOrZero Helpdesk versions prior to 1.6.5.4

Description The issue concerns the "forgot password" function, which generates insecure passwords. This is done by concatenating the current timestamp with the username, allowing remote attackers to gain access as an arbitrary user by requesting a password reset.

Recommendations For versions prior to 1.6.5.4, update to version 1.6.5.4 or later to resolve the issue. As a temporary workaround, consider disabling the "forgot password" function until a patch is available. Restrict access to the password reset feature to minimize the risk of exploitation. Avoid using the username in conjunction with the password reset mechanism until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5474

Affected Products

Oneorzero Helpdesk

References · 7

• 🔥 http://whitedust.net/speaks/3043 · Exploit
• http://secunia.com/advisories/22476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5474 · Security Note
• http://oneorzero.com/downloads/release_notes/Current_Release_notes.html · Patch
• http://securityreason.com/securityalert/1767 · Note
• http://securityfocus.com/bid/20651 · Note
• http://securityfocus.com/archive/1/449352/100/0/threaded · Note