PT-2007-7197 · Meridian · Meridian Prolog Manager

Published 2007-12-13 · Updated 2018-10-15 · CVE-2007-6330

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Meridian Prolog Manager versions 2007, 7.5 and earlier

Description The issue allows remote attackers to obtain database access by capturing credentials via a man-in-the-middle attack, as it sends all usernames and passwords to the client in a cleartext or weakly encrypted format to support client-side login authentication.

Recommendations For Meridian Prolog Manager versions 2007, 7.5 and earlier, consider disabling client-side login authentication until a secure method for transmitting credentials is implemented. Restrict access to sensitive areas of the database to minimize the risk of exploitation. Avoid using weak encryption for transmitting usernames and passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-6330

Affected Products

Meridian Prolog Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-6330 · Security Note
• http://kb.cert.org/vuls/id/120593 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38996 · Note
• http://securityfocus.com/archive/1/484886/100/0/threaded · Note
• http://osvdb.org/42634 · Note
• http://kb.cert.org/vuls/id/MIMG-77FL3T · Note
• http://securityfocus.com/bid/26826 · Note
• http://secunia.com/advisories/28065 · Note