PT-2010-1653 · Toutvirtual · Toutvirtual Virtualiq Pro

Published 2010-05-07 · Updated 2018-10-10 · CVE-2009-4845

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ToutVirtual VirtualIQ Pro version 3.2 build 7882

Description The configuration page contains cleartext SSH credentials, allowing remote attackers to obtain sensitive information by reading the username and password fields.

Recommendations For ToutVirtual VirtualIQ Pro version 3.2 build 7882, consider restricting access to the configuration page to minimize the risk of exploitation. As a temporary workaround, avoid using the configuration page until a patch is available that properly secures SSH credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-4845

Affected Products

Toutvirtual Virtualiq Pro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-4845 · Security Note
• http://securenetwork.it/ricerca/advisory/download/SN-2009-02.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58575 · Note
• http://securityfocus.com/archive/1/507729/100/0/threaded · Note