PT-2007-5346 · Visionsoft · Visionsoft Audit

Published 2007-08-03 · Updated 2024-02-09 · CVE-2007-4150

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visionsoft Audit version 12.4.0.0

Description The issue concerns the use of weak cryptography, specifically XOR, in two areas: transmitting passwords over the network and storing passwords in a configuration file. This weakness allows remote attackers to capture sensitive information by monitoring network traffic and enables local users to access sensitive data by reading the configuration file.

Recommendations For Visionsoft Audit version 12.4.0.0, consider disabling the password transmission feature over the network until a secure cryptography method is implemented. Additionally, restrict access to the configuration file to minimize the risk of local users obtaining sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2007-4150

Affected Products

Visionsoft Audit

References · 4

• http://portcullis.co.uk/uplds/advisories/vapassword%20-%2006-042.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4150 · Security Note
• http://securityfocus.com/bid/25153 · Note
• http://osvdb.org/46979 · Note