PT-2008-5859 · Websense · Websense Enterprise

Published 2008-10-21 · Updated 2011-03-08 · CVE-2008-4646

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Enterprise version 6.3.2

Description The issue concerns the storage of the SQL database system administrator password in plaintext within a log file, specifically CreateDbInstall.log, by the Websense Reporter Module. This allows local users to obtain the password and gain privileges to the database.

Recommendations For Websense Enterprise version 6.3.2, consider restricting access to the CreateDbInstall.log file to prevent unauthorized users from obtaining the database administrator password. Additionally, as a temporary workaround, manually encrypt or securely store the SQL database system administrator password until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-4646

Affected Products

Websense Enterprise

References · 6

• http://secunia.com/advisories/32264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4646 · Security Note
• http://securityfocus.com/bid/31746 · Note
• http://securitytracker.com/id?1021058 · Note
• http://vupen.com/english/advisories/2008/2819 · Note
• http://zebux.org/pub/Advisory/Advisory_Websense_Reporter_Password_Disclosure_200810.txt · Note