PT-2013-4526 · Baramundi · Baramundi Management Suite

Damir Bozic · Published 2013-10-03 · Updated 2013-10-03 · CVE-2013-3625

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Baramundi Management Suite versions 7.5 through 8.9

Description The issue involves an unspecified DLL file in the software that uses a hardcoded encryption key. This makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.

Recommendations For versions 7.5 through 8.9, consider restricting access to the affected DLL file until a patch is available. As a temporary workaround, avoid using the cryptographic protection mechanisms that rely on the hardcoded encryption key. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-3625

Affected Products

Baramundi Management Suite

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-3625 · Security Note
• http://kb.cert.org/vuls/id/392654 · Note