PT-2007-1316 · Ptc · Mathcad

Published 2007-02-23 · Updated 2018-10-16 · CVE-2006-7037

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mathcad versions 12 through 13.1

Description The issue allows local users to bypass security features by directly accessing or editing the XML representation of the worksheet with a text editor or other program. This enables attackers to bypass password protection by replacing the password field with a hash of a known password, modify timestamps to avoid detection of modifications, remove locks by removing the is-locked attribute, and view locked data, which is stored in plaintext.

Recommendations For Mathcad versions 12 through 13.1, consider restricting access to the XML representation of worksheets to prevent unauthorized editing, and avoid storing sensitive data in plaintext. As a temporary workaround, consider implementing additional security measures, such as encrypting sensitive data and using external access control mechanisms to prevent unauthorized access.

Fix

Related Identifiers

CVE-2006-7037

Affected Products

Mathcad

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-7037 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27117 · Note
• http://securityfocus.com/archive/1/436441/30/4560/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27116 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27115 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27118 · Note
• http://securityreason.com/securityalert/2305 · Note