PT-2015-4288 · Vdg Security · Vdg Security Sense

Stefan Viehböck · Published 2015-01-08 · Updated 2017-03-07 · CVE-2014-9578

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VDG Security SENSE (formerly DIVA) version 2.3.13

Description The issue allows remote attackers to gain login access by leveraging knowledge of a password hash, as the system performs authentication with a password hash instead of a password.

Recommendations For VDG Security SENSE (formerly DIVA) version 2.3.13, consider updating to a version that performs authentication with passwords instead of password hashes to prevent remote attackers from gaining login access by leveraging knowledge of a password hash. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-9578

Affected Products

Vdg Security Sense

References · 4

• 🔥 http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Dec/76 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9578 · Security Note